@astrale-os/sdk 0.5.0-beta.13 → 0.5.0-beta.130

package/dist/tooling/linter/implementations/source/actions.js

@@ -0,0 +1,184 @@
+import ts from 'typescript';
+import { importedSymbol, resolveProjectImport, unwrap, visit, } from '../../adapters/typescript/index.js';
+import { ambiguity, production, violation } from './shared.js';
+export const actionRules = [
+    {
+        id: 'FNC-ONE-IMPL',
+        ruleRevision: '98a614772dec03f5a5c669d0b0efcca8d811a2ed6de91347c38c6bd06fe2a84e',
+        evaluate(project) {
+            const evidence = [];
+            const registered = new Map();
+            const compositionPaths = new Set(project.policy.rootFiles
+                .filter(({ role }) => role === 'composition')
+                .map(({ sourcePath }) => sourcePath));
+            const roots = production(project).filter(({ path }) => compositionPaths.has(path));
+            for (const file of roots) {
+                visit(file.source, (node) => {
+                    if (!ts.isCallExpression(node) || !isDefineRuntimeCall(file, node))
+                        return;
+                    const input = node.arguments[0] && unwrap(node.arguments[0]);
+                    if (!input || !ts.isObjectLiteralExpression(input)) {
+                        evidence.push(ambiguity(file, node, 'defineRuntime input is not a static object literal.'));
+                        return;
+                    }
+                    const functions = input.properties.find((property) => (ts.isPropertyAssignment(property) || ts.isShorthandPropertyAssignment(property)) &&
+                        (ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)) &&
+                        property.name.text === 'functions');
+                    if (!functions)
+                        return;
+                    const registry = ts.isPropertyAssignment(functions)
+                        ? unwrap(functions.initializer)
+                        : ts.isShorthandPropertyAssignment(functions)
+                            ? resolveLocalInitializer(file.source, functions.name.text)
+                            : undefined;
+                    if (!registry) {
+                        evidence.push(ambiguity(file, functions, 'defineRuntime functions binding cannot be resolved locally.'));
+                        return;
+                    }
+                    const objectValues = inspectObjectValuesRegistry(project, file, registry);
+                    if (objectValues.kind === 'valid')
+                        return;
+                    if (objectValues.kind === 'invalid') {
+                        evidence.push(objectValues.ambiguous
+                            ? ambiguity(file, registry, objectValues.message)
+                            : violation(file, registry, objectValues.message));
+                        return;
+                    }
+                    if (!ts.isArrayLiteralExpression(registry)) {
+                        evidence.push(ambiguity(file, registry, 'defineRuntime functions is not a static array literal.'));
+                        return;
+                    }
+                    visitActionLeaves(registry, (expression) => {
+                        const value = unwrap(expression);
+                        if (!ts.isIdentifier(value)) {
+                            evidence.push(violation(file, value, 'Function must be one imported Functions binding.'));
+                            return;
+                        }
+                        const symbol = importedSymbol(file, value);
+                        const sourceImport = symbol && file.imports.find(({ specifier }) => specifier === symbol.module);
+                        const target = sourceImport && resolveProjectImport(project, file, sourceImport.specifier);
+                        if (target?.layer === 'functions' && !target.submodule) {
+                            evidence.push(ambiguity(file, value, `Function ${value.text} reaches the Functions layer facade but its ultimate semantic submodule owner is unresolved.`));
+                            return;
+                        }
+                        if (!target || target.layer !== 'functions' || !target.submodule) {
+                            evidence.push(violation(file, value, `Function ${value.text} is not owned by one Functions submodule.`));
+                            return;
+                        }
+                        const key = `${target.path}\0${symbol.name}`;
+                        if (registered.has(key)) {
+                            evidence.push(violation(file, value, `Function ${value.text} is registered more than once from ${target.path}.`));
+                        }
+                        else {
+                            registered.set(key, value);
+                        }
+                    });
+                });
+            }
+            return evidence;
+        },
+    },
+];
+function isDefineRuntimeCall(file, node) {
+    const factory = unwrap(node.expression);
+    return (ts.isCallExpression(factory) &&
+        importedSymbol(file, factory.expression)?.name === 'defineRuntime');
+}
+function inspectObjectValuesRegistry(project, file, expression) {
+    if (!ts.isCallExpression(expression) ||
+        !ts.isPropertyAccessExpression(unwrap(expression.expression)) ||
+        unwrap(expression.expression).getText() !== 'Object.values' ||
+        expression.arguments.length !== 1) {
+        return { kind: 'not-object-values' };
+    }
+    const binding = unwrap(expression.arguments[0]);
+    if (!ts.isIdentifier(binding)) {
+        return {
+            kind: 'invalid',
+            message: 'Object.values Functions registry must use one imported Functions facade.',
+            ambiguous: false,
+        };
+    }
+    const symbol = importedSymbol(file, binding);
+    const namespaceModule = file.source.statements.find((statement) => ts.isImportDeclaration(statement) &&
+        statement.importClause?.namedBindings !== undefined &&
+        ts.isNamespaceImport(statement.importClause.namedBindings) &&
+        statement.importClause.namedBindings.name.text === binding.text)?.moduleSpecifier;
+    const module = symbol?.module ??
+        (namespaceModule && ts.isStringLiteral(namespaceModule) ? namespaceModule.text : undefined);
+    const sourceImport = module === undefined ? undefined : file.imports.find(({ specifier }) => specifier === module);
+    const target = sourceImport && resolveProjectImport(project, file, sourceImport.specifier);
+    if (target?.layer !== 'functions' || target.submodule) {
+        return {
+            kind: 'invalid',
+            message: 'Object.values Functions registry must resolve to the Functions layer facade.',
+            ambiguous: target === undefined,
+        };
+    }
+    let exported = 0;
+    for (const statement of target.source.statements) {
+        if (ts.isExportDeclaration(statement)) {
+            if (statement.moduleSpecifier === undefined ||
+                !ts.isStringLiteral(statement.moduleSpecifier) ||
+                statement.exportClause === undefined ||
+                !ts.isNamedExports(statement.exportClause)) {
+                return {
+                    kind: 'invalid',
+                    message: 'Functions facade must use explicit named re-exports from semantic submodules.',
+                    ambiguous: false,
+                };
+            }
+            const owner = resolveProjectImport(project, target, statement.moduleSpecifier.text);
+            if (owner === undefined) {
+                return {
+                    kind: 'invalid',
+                    message: 'Functions facade re-export owner cannot be resolved.',
+                    ambiguous: true,
+                };
+            }
+            if (owner.layer !== 'functions' || !owner.submodule) {
+                return {
+                    kind: 'invalid',
+                    message: 'Functions facade re-exports a value without one semantic Functions submodule owner.',
+                    ambiguous: false,
+                };
+            }
+            exported += statement.exportClause.elements.length;
+            continue;
+        }
+        const modifiers = ts.canHaveModifiers(statement) ? ts.getModifiers(statement) : undefined;
+        if (ts.isExportAssignment(statement) ||
+            modifiers?.some(({ kind }) => kind === ts.SyntaxKind.ExportKeyword)) {
+            return {
+                kind: 'invalid',
+                message: 'Functions facade exports a root-owned value without a semantic submodule owner.',
+                ambiguous: false,
+            };
+        }
+    }
+    return exported > 0
+        ? { kind: 'valid' }
+        : {
+            kind: 'invalid',
+            message: 'Functions facade exports no statically owned Function bindings.',
+            ambiguous: false,
+        };
+}
+function visitActionLeaves(array, callback) {
+    for (const element of array.elements) {
+        callback(ts.isSpreadElement(element) ? element.expression : element);
+    }
+}
+function resolveLocalInitializer(source, name) {
+    let result;
+    visit(source, (node) => {
+        if (!result &&
+            ts.isVariableDeclaration(node) &&
+            ts.isIdentifier(node.name) &&
+            node.name.text === name &&
+            node.initializer) {
+            result = unwrap(node.initializer);
+        }
+    });
+    return result;
+}

package/dist/tooling/linter/implementations/source/callable-requirements.d.ts

@@ -0,0 +1,28 @@
+import ts from 'typescript';
+import { type SourceFile, type SourceProject } from '../../adapters/typescript/index.js';
+export interface RemoteCallable {
+    readonly file: SourceFile;
+    readonly node: ts.CallExpression;
+    readonly module: string;
+    readonly selector: readonly string[];
+}
+export interface FunctionRequirements {
+    readonly keys: ReadonlySet<string>;
+    readonly indeterminate: boolean;
+}
+export declare function applicationFunctionRequirements(project: SourceProject): FunctionRequirements;
+export declare function requiredCallable(project: SourceProject, file: SourceFile, input: ts.Expression): Pick<RemoteCallable, 'module' | 'selector'> | undefined;
+export declare function declaredDomainDependencies(project: SourceProject): {
+    readonly aliases: ReadonlyMap<string, string>;
+    readonly indeterminate: boolean;
+};
+export declare function callableSelector(selector: readonly string[]): boolean;
+export declare function externalFacade(module: string): boolean;
+export declare function remoteCallableKey(input: Pick<RemoteCallable, 'module' | 'selector'>): string;
+export declare function callableReference(expression: ts.Expression): {
+    readonly expression: ts.Expression;
+    readonly resolved: boolean;
+};
+/** Resolve only one immutable lexical alias; the linter does not emulate program execution. */
+export declare function lexicalConstInitializer(identifier: ts.Identifier): ts.Expression | undefined;
+export declare function bindingContains(binding: ts.BindingName, name: string): boolean;

package/dist/tooling/linter/implementations/source/callable-requirements.js

@@ -0,0 +1,234 @@
+import ts from 'typescript';
+import { objectProperty, resolveImportedSymbol, resolveProjectImport, unwrap, visit, } from '../../adapters/typescript/index.js';
+import { definitionObjects, DSL_MODULES, production, propertyExpression } from './shared.js';
+export function applicationFunctionRequirements(project) {
+    const applicationPath = project.policy.rootFiles.find(({ id }) => id === 'application')?.sourcePath;
+    const file = applicationPath && project.filesByPath.get(applicationPath);
+    if (!file)
+        return { keys: new Set(), indeterminate: true };
+    const applications = [];
+    visit(file.source, (node) => {
+        if (!ts.isCallExpression(node))
+            return;
+        const symbol = resolveImportedSymbol(file, node.expression);
+        if (symbol.kind === 'resolved' &&
+            symbol.name === 'defineApplication' &&
+            (symbol.module === '@astrale-os/sdk' || symbol.module === '@astrale-os/sdk/application')) {
+            applications.push(node);
+        }
+    });
+    if (applications.length !== 1)
+        return { keys: new Set(), indeterminate: true };
+    const input = applications[0].arguments[0];
+    if (!input || !ts.isObjectLiteralExpression(unwrap(input))) {
+        return { keys: new Set(), indeterminate: true };
+    }
+    const requirementsProperty = objectProperty(unwrap(input), 'requirements');
+    if (requirementsProperty === undefined)
+        return { keys: new Set(), indeterminate: false };
+    const requirementsInput = ts.isPropertyAssignment(requirementsProperty)
+        ? requirementsProperty.initializer
+        : ts.isShorthandPropertyAssignment(requirementsProperty)
+            ? requirementsProperty.name
+            : undefined;
+    if (!requirementsInput)
+        return { keys: new Set(), indeterminate: true };
+    const requirementsCall = callableReference(unwrap(requirementsInput)).expression;
+    if (!ts.isCallExpression(requirementsCall))
+        return { keys: new Set(), indeterminate: true };
+    const requirementsSymbol = resolveImportedSymbol(file, requirementsCall.expression);
+    if (requirementsSymbol.kind !== 'resolved' ||
+        requirementsSymbol.name !== 'requirements' ||
+        (requirementsSymbol.module !== '@astrale-os/sdk' &&
+            requirementsSymbol.module !== '@astrale-os/sdk/application')) {
+        return { keys: new Set(), indeterminate: true };
+    }
+    const definition = requirementsCall.arguments[0];
+    if (definition === undefined)
+        return { keys: new Set(), indeterminate: false };
+    if (!ts.isObjectLiteralExpression(unwrap(definition))) {
+        return { keys: new Set(), indeterminate: true };
+    }
+    const functions = objectProperty(unwrap(definition), 'functions');
+    if (functions === undefined)
+        return { keys: new Set(), indeterminate: false };
+    if (!ts.isPropertyAssignment(functions))
+        return { keys: new Set(), indeterminate: true };
+    const values = unwrap(functions.initializer);
+    if (!ts.isArrayLiteralExpression(values))
+        return { keys: new Set(), indeterminate: true };
+    const keys = new Set();
+    let indeterminate = false;
+    for (const element of values.elements) {
+        if (ts.isSpreadElement(element)) {
+            indeterminate = true;
+            continue;
+        }
+        const target = requiredCallable(project, file, element);
+        if (target === undefined)
+            indeterminate = true;
+        else
+            keys.add(remoteCallableKey(target));
+    }
+    return { keys, indeterminate };
+}
+export function requiredCallable(project, file, input) {
+    const admitted = callableReference(unwrap(input));
+    if (!admitted.resolved)
+        return undefined;
+    let current = admitted.expression;
+    const selector = [];
+    while (ts.isPropertyAccessExpression(unwrap(current))) {
+        const property = unwrap(current);
+        selector.unshift(property.name.text);
+        current = unwrap(property.expression);
+    }
+    if (ts.isIdentifier(current))
+        current = callableReference(current).expression;
+    if (!ts.isCallExpression(current))
+        return undefined;
+    const resolve = unwrap(current.expression);
+    if (!ts.isPropertyAccessExpression(resolve) || resolve.name.text !== 'resolve')
+        return undefined;
+    const schemaSymbol = resolveImportedSymbol(file, resolve.expression);
+    if (schemaSymbol.kind !== 'resolved' ||
+        schemaSymbol.name !== 'schema' ||
+        schemaSymbol.module !== '@astrale-os/sdk/schema') {
+        return undefined;
+    }
+    const schemaValue = current.arguments[0];
+    if (!schemaValue)
+        return undefined;
+    const facade = resolveImportedSymbol(file, schemaValue);
+    if (facade.kind === 'resolved' && externalFacade(facade.module)) {
+        if (!callableSelector(selector))
+            return undefined;
+        return { module: facade.module, selector: Object.freeze(selector) };
+    }
+    if (facade.kind === 'local')
+        return undefined;
+    const localSchema = resolveProjectImport(project, file, facade.module);
+    if (facade.name !== 'schema' ||
+        localSchema?.layer !== 'schema' ||
+        selector[0] !== 'dependencies' ||
+        selector[1] === undefined) {
+        return undefined;
+    }
+    const callable = selector.slice(2);
+    if (!callableSelector(callable))
+        return undefined;
+    const dependency = declaredDomainDependencies(project).aliases.get(selector[1]);
+    return dependency === undefined
+        ? undefined
+        : { module: dependency, selector: Object.freeze(callable) };
+}
+export function declaredDomainDependencies(project) {
+    const aliases = new Map();
+    let indeterminate = false;
+    let definitions = 0;
+    for (const file of production(project, 'schema')) {
+        for (const definition of definitionObjects(file, 'defineSchema', undefined, DSL_MODULES, 1)) {
+            definitions++;
+            if (definition.origin !== 'resolved' || !definition.object) {
+                indeterminate = true;
+                continue;
+            }
+            const value = propertyExpression(definition.object, 'dependencies');
+            if (!value)
+                continue;
+            if (!ts.isObjectLiteralExpression(value)) {
+                indeterminate = true;
+                continue;
+            }
+            for (const property of value.properties) {
+                const input = ts.isPropertyAssignment(property)
+                    ? property.initializer
+                    : ts.isShorthandPropertyAssignment(property)
+                        ? property.name
+                        : undefined;
+                const name = property.name;
+                const alias = name && (ts.isIdentifier(name) || ts.isStringLiteral(name)) ? name.text : undefined;
+                if (!input || !alias) {
+                    indeterminate = true;
+                    continue;
+                }
+                const symbol = resolveImportedSymbol(file, input);
+                if (symbol.kind === 'resolved' &&
+                    symbol.name === 'KernelSchema' &&
+                    ['@astrale-os/sdk/schema', '@astrale-os/kernel-core'].includes(symbol.module)) {
+                    continue;
+                }
+                if (symbol.kind !== 'resolved' || !externalFacade(symbol.module)) {
+                    indeterminate = true;
+                    continue;
+                }
+                if (aliases.has(alias) && aliases.get(alias) !== symbol.module) {
+                    aliases.delete(alias);
+                    indeterminate = true;
+                    continue;
+                }
+                aliases.set(alias, symbol.module);
+            }
+        }
+    }
+    return { aliases, indeterminate: indeterminate || definitions !== 1 };
+}
+export function callableSelector(selector) {
+    return ((selector.length === 2 && selector[0] === 'functions') ||
+        (selector.length === 4 && selector[0] === 'classes' && selector[2] === 'methods') ||
+        (selector.length === 5 &&
+            selector[0] === 'classes' &&
+            selector[2] === 'static' &&
+            selector[3] === 'methods'));
+}
+export function externalFacade(module) {
+    return (!module.startsWith('.') &&
+        !module.startsWith('#') &&
+        !module.startsWith('@astrale-os/sdk') &&
+        !module.startsWith('@astrale-os/kernel-'));
+}
+export function remoteCallableKey(input) {
+    return `${input.module}\0${input.selector.join('\0')}`;
+}
+export function callableReference(expression) {
+    if (!ts.isIdentifier(expression))
+        return { expression, resolved: true };
+    const initializer = lexicalConstInitializer(expression);
+    return initializer === undefined
+        ? { expression, resolved: false }
+        : { expression: unwrap(initializer), resolved: true };
+}
+/** Resolve only one immutable lexical alias; the linter does not emulate program execution. */
+export function lexicalConstInitializer(identifier) {
+    let child = identifier;
+    let current = identifier.parent;
+    while (current) {
+        if (ts.isFunctionLike(current)) {
+            if (current.parameters.some(({ name }) => bindingContains(name, identifier.text))) {
+                return undefined;
+            }
+        }
+        if (ts.isBlock(current) || ts.isSourceFile(current) || ts.isModuleBlock(current)) {
+            const index = current.statements.findIndex((statement) => statement.pos <= child.pos && statement.end >= child.end);
+            const before = index < 0 ? current.statements : current.statements.slice(0, index);
+            for (const statement of [...before].reverse()) {
+                if (!ts.isVariableStatement(statement))
+                    continue;
+                const declaration = statement.declarationList.declarations.find(({ name }) => ts.isIdentifier(name) && name.text === identifier.text);
+                if (!declaration)
+                    continue;
+                return (statement.declarationList.flags & ts.NodeFlags.Const) !== 0
+                    ? declaration.initializer
+                    : undefined;
+            }
+        }
+        child = current;
+        current = current.parent;
+    }
+    return undefined;
+}
+export function bindingContains(binding, name) {
+    if (ts.isIdentifier(binding))
+        return binding.text === name;
+    return binding.elements.some((element) => !ts.isOmittedExpression(element) && bindingContains(element.name, name));
+}

package/dist/tooling/linter/implementations/source/dependencies.d.ts

@@ -0,0 +1,2 @@
+import type { SourceRuleVerifier } from './verifier.js';
+export declare const dependencyRules: readonly SourceRuleVerifier[];

package/dist/tooling/linter/implementations/source/dependencies.js

@@ -0,0 +1,219 @@
+import ts from 'typescript';
+import { propertyChain, resolveImportedSymbol, unwrap, visit, } from '../../adapters/typescript/index.js';
+import { applicationFunctionRequirements, callableReference, callableSelector, declaredDomainDependencies, remoteCallableKey, } from './callable-requirements.js';
+import { ambiguity, calls, isForeignDomain, production, violation } from './shared.js';
+export const dependencyRules = [
+    {
+        id: 'FNC-XDOM-DECLARED',
+        ruleRevision: '269e22202a0fbec5ec4afc3579ca504eed457f44046b99e64a38d08634294909',
+        evaluate(project) {
+            const evidence = [];
+            for (const file of production(project, 'functions')) {
+                for (const sourceImport of file.imports) {
+                    if (isForeignDomain(sourceImport.specifier))
+                        evidence.push(violation(file, sourceImport.node, `Handler imports foreign Domain ${sourceImport.specifier}; use declared dependencies or an Integration.`));
+                }
+            }
+            return [...evidence, ...observeInvocations(project).evidence];
+        },
+    },
+    {
+        id: 'FNC-XDOM-REQ',
+        ruleRevision: 'a646c9931bb8b5a011a2cf7431f362fcb0e63be49dfc4c1bc0eba77a8aca8fdb',
+        evaluate(project) {
+            const { targets, evidence } = observeInvocations(project);
+            const declared = applicationFunctionRequirements(project);
+            const results = evidence.filter(({ kind }) => kind === 'ambiguity');
+            for (const target of targets) {
+                if (declared.keys.has(remoteCallableKey(target)))
+                    continue;
+                results.push((declared.indeterminate ? ambiguity : violation)(target.file, target.node, `Remote Domain callable ${target.module} ${target.selector.join('.')} lacks one provable exact Application Function requirement.`));
+            }
+            return results;
+        },
+    },
+];
+function observeInvocations(project) {
+    const dependencies = declaredDomainDependencies(project);
+    const targets = [];
+    const evidence = [];
+    for (const file of production(project, 'functions')) {
+        for (const definition of [...calls(file, 'defineAction'), ...calls(file, 'defineWorkflow')]) {
+            if (definition.origin === 'ambiguous') {
+                evidence.push(ambiguity(file, definition.call, 'Handler definition resolves through a local facade whose ultimate public constructor origin is unknown.'));
+                continue;
+            }
+            const call = ts.isCallExpression(definition.call.parent) &&
+                definition.call.parent.expression === definition.call
+                ? definition.call.parent
+                : definition.call;
+            const candidate = call.arguments.length === 2
+                ? call.arguments[1]
+                : call.arguments.length === 3
+                    ? call.arguments[2]
+                    : undefined;
+            const run = candidate && unwrap(candidate);
+            if (!run || (!ts.isArrowFunction(run) && !ts.isFunctionExpression(run))) {
+                evidence.push(ambiguity(file, call, 'Handler run is not a static function.'));
+                continue;
+            }
+            visit(run.body, (node) => {
+                if (!ts.isCallExpression(node))
+                    return;
+                const path = contextPath(node.expression, run);
+                if (!path || path.at(-1) !== 'invoke')
+                    return;
+                if (path.includes('[computed]')) {
+                    evidence.push(ambiguity(file, node, 'Computed dependency invocation cannot be proven statically.'));
+                    return;
+                }
+                let alias;
+                let selector;
+                if (path[0] === 'dependencies') {
+                    if (path.length !== 4 || !['caller', 'self', 'union'].includes(path[2])) {
+                        evidence.push(violation(file, node, 'Dependency invocation requires one direct alias and one explicit caller, self, or union authority.'));
+                        return;
+                    }
+                    alias = path[1];
+                    selector = selectedCallable(node.arguments[0]);
+                }
+                else if (path[0] === 'kernel' &&
+                    (path.length === 2 ||
+                        (path.length === 3 && ['caller', 'self', 'union'].includes(path[1])))) {
+                    const argument = node.arguments[0];
+                    if (!argument) {
+                        evidence.push(violation(file, node, 'Kernel invocation requires one canonical typed reference.'));
+                        return;
+                    }
+                    const admitted = callableReference(unwrap(argument));
+                    let reference = admitted.expression;
+                    if (ts.isCallExpression(reference) && ts.isCallExpression(reference.expression))
+                        reference = reference.expression;
+                    if (!admitted.resolved) {
+                        evidence.push(ambiguity(file, node, 'Kernel invocation reference is opaque.'));
+                        return;
+                    }
+                    const symbol = ts.isCallExpression(reference)
+                        ? resolveImportedSymbol(file, reference.expression)
+                        : undefined;
+                    if (symbol?.kind !== 'resolved' ||
+                        symbol.module !== '@astrale-os/sdk/client/session' ||
+                        symbol.name !== 'reference' ||
+                        !ts.isCallExpression(reference)) {
+                        evidence.push(violation(file, node, 'Kernel invocation requires one canonical typed reference.'));
+                        return;
+                    }
+                    const domain = reference.arguments[0] && contextPath(reference.arguments[0], run);
+                    const callable = reference.arguments[1] && contextPath(reference.arguments[1], run);
+                    // Local typed Kernel invocations are outside cross-Domain requirement policy.
+                    if (domain?.length === 1 && domain[0] === 'domain')
+                        return;
+                    if (domain?.length === 3 &&
+                        domain[0] === 'domain' &&
+                        domain[1] === 'dependencies' &&
+                        callable &&
+                        domain.every((part, index) => part === callable[index])) {
+                        alias = domain[2];
+                        selector = callable.slice(3);
+                    }
+                }
+                else
+                    return;
+                if (!alias || !selector || !callableSelector(selector)) {
+                    evidence.push(ambiguity(file, node, 'Remote callable selector cannot be proven from one static selector or typed reference.'));
+                    return;
+                }
+                const module = dependencies.aliases.get(alias);
+                if (!module) {
+                    evidence.push((dependencies.indeterminate ? ambiguity : violation)(file, node, `Dependency alias ${alias} is not one declared public Domain dependency.`));
+                    return;
+                }
+                targets.push({ file, node, module, selector });
+            });
+        }
+    }
+    return { targets, evidence };
+}
+function selectedCallable(input) {
+    if (!input)
+        return undefined;
+    const admitted = callableReference(unwrap(input));
+    const selector = admitted.expression;
+    if (!admitted.resolved ||
+        (!ts.isArrowFunction(selector) && !ts.isFunctionExpression(selector)) ||
+        selector.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword))
+        return undefined;
+    const parameter = selector.parameters[0]?.name;
+    if (!parameter || !ts.isIdentifier(parameter))
+        return undefined;
+    let expression;
+    if (ts.isBlock(selector.body)) {
+        if (selector.body.statements.length === 1 && ts.isReturnStatement(selector.body.statements[0]))
+            expression = selector.body.statements[0].expression;
+    }
+    else
+        expression = selector.body;
+    const chain = expression && propertyChain(expression);
+    return chain && chain[0] === parameter.text ? chain.slice(1) : undefined;
+}
+/** Resolve handler context bindings and one immutable local alias without following arbitrary helpers. */
+function contextPath(input, run, aliases = 1) {
+    const expression = unwrap(input);
+    if (ts.isPropertyAccessExpression(expression)) {
+        const base = contextPath(expression.expression, run, aliases);
+        return base && [...base, expression.name.text];
+    }
+    if (ts.isElementAccessExpression(expression)) {
+        const base = contextPath(expression.expression, run, aliases);
+        return base && [...base, '[computed]'];
+    }
+    if (!ts.isIdentifier(expression))
+        return undefined;
+    let current = expression.parent;
+    while (current) {
+        if (ts.isFunctionLike(current)) {
+            for (const parameter of current.parameters) {
+                const path = bindingPath(parameter.name, expression.text);
+                if (path)
+                    return current === run && parameter === run.parameters[0] ? path : undefined;
+            }
+        }
+        if (ts.isBlock(current) || ts.isSourceFile(current)) {
+            for (const statement of current.statements) {
+                if (ts.isFunctionDeclaration(statement) && statement.name?.text === expression.text)
+                    return undefined;
+                if (!ts.isVariableStatement(statement))
+                    continue;
+                for (const declaration of statement.declarationList.declarations) {
+                    const path = bindingPath(declaration.name, expression.text);
+                    if (!path)
+                        continue;
+                    if (aliases === 0 ||
+                        !declaration.initializer ||
+                        declaration.end > expression.pos ||
+                        !(statement.declarationList.flags & ts.NodeFlags.Const))
+                        return undefined;
+                    const base = contextPath(declaration.initializer, run, aliases - 1);
+                    return base && [...base, ...path];
+                }
+            }
+        }
+        current = current.parent;
+    }
+    return undefined;
+}
+function bindingPath(name, identifier) {
+    if (ts.isIdentifier(name))
+        return name.text === identifier ? [] : undefined;
+    if (!ts.isObjectBindingPattern(name))
+        return undefined;
+    for (const element of name.elements) {
+        if (element.dotDotDotToken)
+            continue;
+        const nested = bindingPath(element.name, identifier);
+        const property = element.propertyName ?? (ts.isIdentifier(element.name) ? element.name : undefined);
+        if (nested && property && (ts.isIdentifier(property) || ts.isStringLiteral(property)))
+            return [property.text, ...nested];
+    }
+    return undefined;
+}

package/dist/tooling/linter/implementations/source/global.d.ts

@@ -0,0 +1,2 @@
+import type { SourceRuleVerifier } from './verifier.js';
+export declare const globalRules: readonly SourceRuleVerifier[];