@cplieger/deadset-ts 8.0.0-dev.6 → 8.0.0-dev.8

package/dist/src/resolve.js

@@ -1,779 +1,300 @@
-import { SEVERITIES, LANGUAGES, CONFIDENCES, FORMATS, FAMILY_KEY_LENGTH, } from "./contract/contract.generated.js";
-import { ConfigError, defaultConfig, } from "./config.js";
+import { SETTINGS } from "./contract/config.generated.js";
+import { FAMILY_KEY_LENGTH } from "./contract/contract.generated.js";
+import {} from "./config.js";
 import { CONVENTION_ROWS } from "./convention-rows.js";
-import { FIXED_SEVERITY_CODES, LIVE_CODES } from "./kinds.js";
-import { checkDocument, malformed, nestFlags, SCHEMA_ROOT, SEVERITY_SECTION, } from "./schema.js";
-/** Names the command-line flags in a refusal, where a document is named by its path. */
-const FLAGS_LABEL = "the command-line flags";
-const SEVERITY_KEY = /^DS[0-9]{2}([0-9]{2})?$/u;
-const EXEMPTION_CLASS = /^[a-z][a-z0-9-]*$/u;
-const CONTRACT_VERSION_PATTERN = /^[0-9]+\.[0-9]+\.[0-9]+$/u;
-const ANALYZER_NAME = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/u;
-const PROVIDER_SOURCE = /^(go|npm):[^ \t\r\n]+$/u;
-const PROVIDER_VERSION = /^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/u;
-const PROVIDER_DIGEST = /^sha256:[0-9a-f]{64}$/u;
-/** The members only an acquirable provider entry carries. */
-const ACQUIRABLE_MEMBERS = ["source", "version", "digest"];
-/** The members only a platform build configuration carries. */
-const PLATFORM_MEMBERS = ["os", "arch", "tags"];
-/** The member only a project build configuration carries. */
-const PROJECT_MEMBER = "project";
+import { refuseOverBound } from "./fs/document.js";
+import { dotted, isRecord, locatedFault, placeIn, pointerOf, readStrict, StrictJSONError, } from "./json-document.js";
+import { FIXED_SEVERITY_CODES } from "./kinds.js";
+import { LANGUAGE } from "./product.js";
+import { firstRefusal } from "./schema.js";
+import { bytewise } from "./text/compare.js";
+import { UsageError } from "./usage.js";
+const ROWS = new Map(SETTINGS.map((row) => [row.key, row]));
+/** The schema of a section or a keyed section's value, so the validator words its refusal. */
+const OBJECT = { type: "object" };
 /**
- * One segment of a project path: not empty, not `.` or `..`, and holding no
- * solidus or control character.
+ * The settings whose entries name rows of this analyzer's own data, which the
+ * Contract's schema cannot list: a disabled convention names a convention row.
  */
-const PROJECT_SEGMENT = String.raw `(?:[^/.\x00-\x1f\x7f][^/\x00-\x1f\x7f]*|\.[^/.\x00-\x1f\x7f][^/\x00-\x1f\x7f]*|\.\.[^/\x00-\x1f\x7f]+)`;
-/**
- * A project path: segments joined by a solidus, so the path is relative, below
- * the root it is read against, and spelled one way on every machine.
- */
-const PROJECT_PATH = new RegExp(`^${PROJECT_SEGMENT}(?:/${PROJECT_SEGMENT})*$`, "u");
-const TARGET_KINDS = ["application", "library"];
-const GENERATED_FILES = ["exclude", "include"];
-const CONSUMER_TESTS = ["test", "production"];
-const SORTS = ["position", "size"];
-const CASCADES = ["roots", "full"];
-/**
- * The origin one setting of this source carries. A flag names itself per setting,
- * because one invocation carries many.
- */
-function originOf(source, path) {
-    if (source.kind === "flag") {
-        return { source: "flag", label: source.flagLabels.get(path) ?? "" };
-    }
-    return { source: source.kind, label: source.label };
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function member(parent, name) {
-    if (parent === undefined || !Object.hasOwn(parent, name)) {
-        return undefined;
-    }
-    return parent[name];
-}
-function section(parent, name, path, label) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
+const OWN_VOCABULARIES = new Map([
+    ["ts.disabled_conventions", new Set(CONVENTION_ROWS.map((row) => row.name))],
+]);
+function malformed(label, path, detail) {
+    return new UsageError(path === "" ? `${label}: ${detail}` : `${label}: ${path}: ${detail}`);
+}
+/** A key the closed key list does not declare, with the reason where there is more to say. */
+function unimplemented(label, path, reason = "") {
+    const why = reason === "" ? "" : `: ${reason}`;
+    return new UsageError(`${label}: key ${JSON.stringify(path)} is not implemented${why}`);
+}
+/** Why a well-formed severity key the vocabulary does not hold names no setting. */
+function severityKeyRefused(key) {
+    const fixed = FIXED_SEVERITY_CODES.filter((code) => code === key || (key.length === FAMILY_KEY_LENGTH && code.startsWith(key))).sort(bytewise);
+    if (fixed.length > 0) {
+        const named = fixed.length < 2
+            ? fixed.join("")
+            : `${fixed.slice(0, -1).join(", ")} and ${String(fixed.at(-1))}`;
+        return `the Contract fixes the severity of ${named}, which this key names`;
+    }
+    return key.length === FAMILY_KEY_LENGTH
+        ? `no issue kind carries a code of the family ${key}`
+        : `no issue kind carries the code ${key}`;
+}
+/** A value with every object's members in ascending order, so it prints one way. */
+function canonical(value) {
+    if (Array.isArray(value)) {
+        return value.map(canonical);
     }
     if (!isRecord(value)) {
-        throw malformed(label, path, "is not an object");
-    }
-    return value;
-}
-function spell(values) {
-    return values.map((value) => JSON.stringify(value)).join(", ");
-}
-function readEnum(parent, name, path, label, allowed) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (typeof value !== "string") {
-        throw malformed(label, path, "is not a string");
-    }
-    if (!allowed.includes(value)) {
-        throw malformed(label, path, `${JSON.stringify(value)} is not one of ${spell(allowed)}`);
-    }
-    return value;
-}
-function readString(parent, name, path, label) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (typeof value !== "string") {
-        throw malformed(label, path, "is not a string");
-    }
-    return value;
-}
-function readBoolean(parent, name, path, label) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (typeof value !== "boolean") {
-        throw malformed(label, path, "is not a boolean");
-    }
-    return value;
-}
-function readCount(parent, name, path, label) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (typeof value !== "number" || !Number.isInteger(value)) {
-        throw malformed(label, path, "is not an integer");
-    }
-    if (value < 0) {
-        throw malformed(label, path, `${String(value)} is below the minimum of 0`);
+        return value;
     }
-    return value;
+    return Object.fromEntries(Object.keys(value)
+        .sort(bytewise)
+        .map((name) => [name, canonical(value[name])]));
 }
 /**
- * One array of strings, refusing an array shorter than its minimum, one holding an
- * empty entry, one naming an entry twice, and, where a closed set is given, one
- * holding an entry outside it.
+ * The walk of one source over the closed key list. The members of an object are checked
+ * in ascending order and a key is checked whole before the next. A key this analyzer's
+ * language does not read is accepted unread, and of a key written per language, every
+ * other language's member.
  */
-function readStrings(parent, name, path, label, minItems, allowed) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!Array.isArray(value)) {
-        throw malformed(label, path, "is not an array");
-    }
-    if (value.length < minItems) {
-        throw malformed(label, path, `holds ${String(value.length)} entries, want at least ${String(minItems)}`);
-    }
-    const seen = new Set();
-    for (const [index, entry] of value.entries()) {
-        const at = `${path}[${String(index)}]`;
-        if (typeof entry !== "string") {
-            throw malformed(label, at, "is not a string");
+class Walk {
+    label;
+    fractions;
+    into;
+    constructor(label, fractions, into) {
+        this.label = label;
+        this.fractions = fractions;
+        this.into = into;
+    }
+    section(at, members) {
+        for (const name of Object.keys(members).sort(bytewise)) {
+            const key = at === "" ? name : `${at}.${name}`;
+            const row = ROWS.get(key);
+            if (name.includes(".")) {
+                const reason = row === undefined ? "" : "it is one setting, written as nested objects";
+                throw unimplemented(this.label, key, reason);
+            }
+            if (row === undefined) {
+                throw unimplemented(this.label, key);
+            }
+            if (row.read) {
+                this.key(row, members[name]);
+            }
         }
-        if (entry === "") {
-            throw malformed(label, at, "is empty");
+    }
+    key(row, value) {
+        if (row.role === "section") {
+            this.refuse(row.key.split("."), value, firstRefusal(OBJECT, value));
+            this.section(row.key, value);
         }
-        if (seen.has(entry)) {
-            throw malformed(label, at, `names ${JSON.stringify(entry)} again`);
+        else if (row.role === "setting") {
+            const read = row.perLanguage === undefined ? value : this.narrowed(row, value);
+            this.setting(row, read);
+            this.into.values.set(row.key, canonical(read));
         }
-        if (allowed !== undefined && !allowed.includes(entry)) {
-            throw malformed(label, at, `${JSON.stringify(entry)} is not one of ${spell(allowed)}`);
+        else {
+            const members = this.keyed(row, value);
+            if (row.role === "keyed") {
+                this.into.keyed.set(row.key, members);
+            }
         }
-        seen.add(entry);
-    }
-    return value;
-}
-/**
- * The target kind, a string or an object naming every language. The walk has
- * already refused an undeclared member, so an object is refused for the first
- * language it leaves out, then for the first language whose value is refused,
- * each in the vocabulary's language order.
- */
-function readTargetKind(target, label) {
-    const value = member(target, "kind");
-    const perLanguage = `an object naming the kind of each of ${spell(LANGUAGES)}`;
-    if (value === undefined) {
-        return undefined;
     }
-    if (typeof value === "string") {
-        if (!TARGET_KINDS.includes(value)) {
-            throw malformed(label, "target.kind", `${JSON.stringify(value)} is not one of ${spell(TARGET_KINDS)}, nor ${perLanguage}`);
+    /** A per-language value as this language reads it: of the object form, its own member alone. */
+    narrowed(row, value) {
+        if (!isRecord(value)) {
+            return value;
         }
-        return value;
-    }
-    if (!isRecord(value)) {
-        throw malformed(label, "target.kind", `${JSON.stringify(value)} is neither one of ${spell(TARGET_KINDS)} nor ${perLanguage}`);
-    }
-    const missing = LANGUAGES.find((language) => !Object.hasOwn(value, language));
-    if (missing !== undefined) {
-        throw malformed(label, `target.kind.${missing}`, `is not set, and ${perLanguage} names each`);
-    }
-    for (const language of LANGUAGES) {
-        const kind = value[language];
-        if (typeof kind !== "string" || !TARGET_KINDS.includes(kind)) {
-            throw malformed(label, `target.kind.${language}`, `${JSON.stringify(kind)} is not one of ${spell(TARGET_KINDS)}`);
+        const others = row.perLanguage ?? [];
+        return Object.fromEntries(Object.entries(value).filter(([name]) => name === LANGUAGE || !others.includes(name)));
+    }
+    setting(row, value) {
+        this.refuse(row.key.split("."), value, firstRefusal(row.value ?? {}, value));
+        const text = this.fractions.get(pointerOf(row.key.split(".")));
+        if (typeof value === "number" && text !== undefined) {
+            throw malformed(this.label, row.key, `holds ${text}, want an integer written as an optional minus sign and digits alone`);
         }
-    }
-    return { go: value["go"], ts: value["ts"] };
-}
-/** A component file's extension: a full stop followed by letters and digits. */
-const COMPONENT_EXTENSION = /^\.[A-Za-z0-9]+$/u;
-function readComponentExtensions(ts, label) {
-    const extensions = readStrings(ts, "component_extensions", "ts.component_extensions", label, 0);
-    const wrong = extensions?.findIndex((one) => !COMPONENT_EXTENSION.test(one)) ?? -1;
-    if (extensions !== undefined && wrong !== -1) {
-        throw malformed(label, `ts.component_extensions[${String(wrong)}]`, `${JSON.stringify(extensions[wrong])} is not a full stop followed by letters and digits`);
-    }
-    return extensions;
-}
-/** The names of the convention rows this analyzer's table carries. */
-const CONVENTION_NAMES = new Set(CONVENTION_ROWS.map((row) => row.name));
-function readDisabledConventions(ts, label) {
-    const names = readStrings(ts, "disabled_conventions", "ts.disabled_conventions", label, 0);
-    const unknown = names?.findIndex((one) => !CONVENTION_NAMES.has(one)) ?? -1;
-    if (names !== undefined && unknown !== -1) {
-        throw malformed(label, `ts.disabled_conventions[${String(unknown)}]`, `${JSON.stringify(names[unknown])} names no convention row this analyzer carries`);
-    }
-    return names;
-}
-function requireMember(value, path, label) {
-    if (value === undefined || value === "") {
-        throw malformed(label, path, "is required and names nothing");
-    }
-    return value;
-}
-/** One build configuration entry as a platform: an identifier, an operating system and an architecture. */
-function readPlatform(entry, at, label) {
-    return {
-        shape: "platform",
-        id: requireMember(readString(entry, "id", `${at}.id`, label), `${at}.id`, label),
-        os: requireMember(readString(entry, "os", `${at}.os`, label), `${at}.os`, label),
-        arch: requireMember(readString(entry, "arch", `${at}.arch`, label), `${at}.arch`, label),
-        tags: readStrings(entry, "tags", `${at}.tags`, label, 0) ?? [],
-    };
-}
-/** One build configuration entry as a project: an identifier and a configuration file below the target root. */
-function readProject(entry, at, label) {
-    const id = requireMember(readString(entry, "id", `${at}.id`, label), `${at}.id`, label);
-    const path = `${at}.${PROJECT_MEMBER}`;
-    const project = requireMember(readString(entry, PROJECT_MEMBER, path, label), path, label);
-    if (!PROJECT_PATH.test(project)) {
-        throw malformed(label, path, `${JSON.stringify(project)} is not a path below the target root: segments joined by /, ` +
-            "none empty, . or .., and no control character");
-    }
-    return { shape: "project", id, project };
-}
-/**
- * One build configuration entry, read as the one shape its members name: a member
- * only a platform carries makes it a platform, the member only a project carries
- * makes it a project, and an entry naming members of both, or of neither, is
- * refused at the entry, because the two shapes are exclusive.
- */
-function readConfiguration(entry, at, label) {
-    if (!isRecord(entry)) {
-        throw malformed(label, at, "is not an object");
-    }
-    const platform = PLATFORM_MEMBERS.filter((name) => Object.hasOwn(entry, name));
-    const project = Object.hasOwn(entry, PROJECT_MEMBER);
-    if (platform.length > 0 && project) {
-        throw malformed(label, at, `carries ${spell(platform)} of a platform and ${JSON.stringify(PROJECT_MEMBER)} of a ` +
-            "project, and an entry is one shape or the other");
-    }
-    if (project) {
-        return readProject(entry, at, label);
-    }
-    if (platform.length === 0) {
-        throw malformed(label, at, `names neither a platform's "os" and "arch" nor a project's ${JSON.stringify(PROJECT_MEMBER)}`);
-    }
-    return readPlatform(entry, at, label);
-}
-/** The build matrix, one entry in one shape at a time. */
-function readConfigurations(analysis, label) {
-    const value = member(analysis, "configurations");
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!Array.isArray(value)) {
-        throw malformed(label, "analysis.configurations", "is not an array");
-    }
-    return value.map((entry, index) => readConfiguration(entry, `analysis.configurations[${String(index)}]`, label));
-}
-/**
- * The action delimiter pair: once a document names the object both members are
- * required, because a pair carrying one member names no delimiters at all, so the
- * refusal names the member the document left out rather than pairing the one it
- * named with a default.
- */
-function readDelimiters(analysis, label) {
-    const at = "analysis.template_delimiters";
-    const pair = section(analysis, "template_delimiters", at, label);
-    if (pair === undefined) {
-        return undefined;
-    }
-    return {
-        left: requireMember(readString(pair, "left", `${at}.left`, label), `${at}.left`, label),
-        right: requireMember(readString(pair, "right", `${at}.right`, label), `${at}.right`, label),
-    };
-}
-/**
- * A severity key that names no setting: it names no live kind, or the Contract
- * fixes the severity of the kind or kinds it names.
- */
-function unimplementedSeverityKey(label, path, reason) {
-    return new ConfigError("unimplemented-key", path, `${label}: key ${JSON.stringify(path)} is not implemented: ${reason}`);
-}
-/**
- * Every code whose severity the Contract fixes that one severity key names, in
- * ascending code order: the code itself, or every code of the family its
- * two-digit prefix names. A family key covers every such code, so a refusal names
- * them all rather than the first one found.
- */
-function fixedByContract(code) {
-    return FIXED_SEVERITY_CODES.filter((candidate) => code === candidate || (code.length === FAMILY_KEY_LENGTH && candidate.startsWith(code))).sort();
-}
-/** The codes a refusal names: one on its own, and several with the last joined by and. */
-function spellCodes(codes) {
-    if (codes.length < 2) {
-        return codes.join("");
-    }
-    return `${codes.slice(0, -1).join(", ")} and ${String(codes[codes.length - 1])}`;
-}
-/** Whether one severity key names a live kind: the code itself, or a family holding one. */
-function namesLiveKind(code) {
-    return LIVE_CODES.some((candidate) => code === candidate || (code.length === FAMILY_KEY_LENGTH && candidate.startsWith(code)));
-}
-/**
- * The severity object, one code at a time.
- *
- * A key is one issue-kind code or one two-digit family prefix. A key naming no
- * live kind, and a key naming a kind whose severity the Contract fixes or a family
- * prefix whose range holds one, is an unimplemented key rather than a setting.
- *
- * Whether a key names a kind this analyzer reports is not decided here: a live
- * kind of another language is a setting the analyzer of that language reads.
- */
-function readSeverity(document, label) {
-    const object = section(document, SEVERITY_SECTION, SEVERITY_SECTION, label);
-    if (object === undefined) {
-        return undefined;
-    }
-    const severity = new Map();
-    for (const code of Object.keys(object).sort()) {
-        const path = `${SEVERITY_SECTION}.${code}`;
-        if (!SEVERITY_KEY.test(code)) {
-            throw unimplementedSeverityKey(label, path, "a severity key is one issue-kind code or one two-digit family prefix");
+        const own = OWN_VOCABULARIES.get(row.key);
+        if (own !== undefined) {
+            const names = value;
+            const unknown = names.findIndex((name) => !own.has(name));
+            if (unknown !== -1) {
+                throw malformed(this.label, `${row.key}[${String(unknown)}]`, `${JSON.stringify(names[unknown])} names no row this analyzer carries`);
+            }
         }
-        if (!namesLiveKind(code)) {
-            throw unimplementedSeverityKey(label, path, code.length === FAMILY_KEY_LENGTH
-                ? "the family this prefix names holds no live issue kind"
-                : "the code names no live issue kind");
+    }
+    /** A keyed or an ignored section: an object whose member names its key pattern admits. */
+    keyed(row, value) {
+        this.refuse(row.key.split("."), value, firstRefusal(OBJECT, value));
+        const members = value;
+        const shape = new RegExp(row.keyPattern ?? "", "u");
+        for (const name of Object.keys(members).sort(bytewise)) {
+            const at = `${row.key}.${name}`;
+            if (!shape.test(name)) {
+                throw unimplemented(this.label, at, `the name does not match ${String(row.keyPattern)}`);
+            }
+            if (row.values !== undefined && !row.values.includes(name)) {
+                throw unimplemented(this.label, at, severityKeyRefused(name));
+            }
+            const member = members[name];
+            this.refuse([...row.key.split("."), name], member, firstRefusal(row.value ?? {}, member));
         }
-        const fixed = fixedByContract(code);
-        if (fixed.length > 0) {
-            throw unimplementedSeverityKey(label, path, `the Contract fixes the severity of ${spellCodes(fixed)}, which this key names`);
+        return members;
+    }
+    /** Throws the refusal the schema makes of `value`, at `at`, naming the place inside it. */
+    refuse(at, value, refused) {
+        if (refused === undefined) {
+            return;
         }
-        const value = readEnum(object, code, path, label, SEVERITIES);
-        if (value !== undefined) {
-            severity.set(code, value);
+        const place = dotted([...at, ...placeIn(value, refused.pointer, refused.member)]);
+        switch (refused.keyword) {
+            case "additionalProperties":
+                throw unimplemented(this.label, place);
+            case "required":
+                throw malformed(this.label, place, "is required and absent");
         }
+        throw malformed(this.label, place, refused.reason);
     }
-    return severity;
 }
-/** The exemption classes named for switching off. */
-function readExemptions(document, label) {
-    const exemptions = section(document, "exemptions", "exemptions", label);
-    const disabled = readStrings(exemptions, "disabled", "exemptions.disabled", label, 0);
-    if (disabled === undefined) {
-        return undefined;
+const supplies = () => ({ values: new Map(), keyed: new Map() });
+/** Reads and checks one configuration document. */
+function documentSource(source, document) {
+    const { text, label } = document;
+    refuseOverBound(label, text);
+    let read;
+    try {
+        read = readStrict(text);
     }
-    for (const entry of disabled) {
-        if (!EXEMPTION_CLASS.test(entry)) {
-            throw malformed(label, "exemptions.disabled", `${JSON.stringify(entry)} is not an exemption class name`);
+    catch (error) {
+        if (!(error instanceof StrictJSONError)) {
+            throw error;
         }
+        throw malformed(label, dotted(error.place), locatedFault(text, error));
     }
-    return disabled;
-}
-/** The members that name a declaration, each belonging to exactly one shape. */
-const SHAPE_MEMBERS = ["symbol", "module", "name", "global"];
-/** The prefix of a stable symbol reference in the TypeScript form. */
-const SYMBOL_PREFIX = "ts://";
-/**
- * A bare specifier: neither relative nor absolute, and not one the package's own
- * imports field maps, each of which names a file of the analyzed program.
- */
-const BARE_SPECIFIER = /^[^./#]/u;
-/**
- * One declaration entry, read as the one shape its members name. An entry carrying
- * members of two shapes, or of none, is refused at the entry, as is a module named
- * without the declaration's path or a path without its module.
- */
-function readDeclaration(entry, at, label) {
-    if (!isRecord(entry)) {
-        throw malformed(label, at, "is not an object");
+    if (!isRecord(read.value)) {
+        throw malformed(label, "", "is not one JSON object");
     }
-    const named = SHAPE_MEMBERS.filter((name) => Object.hasOwn(entry, name));
-    if (named.length === 1 && named[0] === "symbol") {
-        const symbol = requireMember(readString(entry, "symbol", `${at}.symbol`, label), `${at}.symbol`, label);
-        if (!symbol.startsWith(SYMBOL_PREFIX)) {
-            throw malformed(label, `${at}.symbol`, `${JSON.stringify(symbol)} is not a ts:// reference`);
+    const supplied = supplies();
+    new Walk(label, read.fractions, supplied).section("", read.value);
+    return { source, label, supplied };
+}
+/** The command line as a source: each flag checked as the one-setting document it supplies. */
+function flagSource(flags) {
+    const supplied = supplies();
+    for (const key of [...flags.keys()].sort(bytewise)) {
+        const row = ROWS.get(key);
+        const text = flags.get(key) ?? "";
+        if (row?.option === undefined) {
+            throw unimplemented("the command line", key, "no flag supplies it");
         }
-        return { shape: "symbol", symbol };
-    }
-    if (named.length === 1 && named[0] === "global") {
-        const path = `${at}.global`;
-        return {
-            shape: "global",
-            global: requireMember(readString(entry, "global", path, label), path, label),
-        };
-    }
-    if (named.length === 2 && named.includes("module") && named.includes("name")) {
-        const module = requireMember(readString(entry, "module", `${at}.module`, label), `${at}.module`, label);
-        if (!BARE_SPECIFIER.test(module)) {
-            throw malformed(label, `${at}.module`, `${JSON.stringify(module)} is not a bare specifier: a file of the analyzed program is named by its symbol`);
+        const integer = row.value?.["type"] === "integer" && /^-?[0-9]+$/u.test(text);
+        let document = integer ? Number(text) : text;
+        for (const name of key.split(".").reverse()) {
+            document = { [name]: document };
         }
-        const path = `${at}.name`;
-        return {
-            shape: "module",
-            module,
-            name: requireMember(readString(entry, "name", path, label), path, label),
-        };
+        new Walk(`--${row.option}`, new Map(), supplied).section("", document);
     }
-    throw malformed(label, at, named.length === 0
-        ? 'names no declaration: an entry carries "symbol", "module" with "name", or "global"'
-        : `carries ${spell(named)}, which is not one of "symbol", "module" with "name", or "global"`);
+    return { source: "flag", label: "", supplied };
 }
-/** One array of declaration entries, absent where the document does not write it. */
-function readDeclarations(parent, name, path, label) {
-    const value = member(parent, name);
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!Array.isArray(value)) {
-        throw malformed(label, path, "is not an array");
-    }
-    return value.map((entry, index) => readDeclaration(entry, `${path}[${String(index)}]`, label));
+function originOf(held, key) {
+    const label = held.source === "flag" ? `--${String(ROWS.get(key)?.option)}` : held.label;
+    return { source: held.source, label };
 }
-/**
- * One lifecycle contract. The member names are required, and the entry names at least
- * one component declaration or one base class, because a contract naming neither
- * makes no class a component and so retains nothing.
- */
-function readLifecycleContract(entry, at, label) {
-    if (!isRecord(entry)) {
-        throw malformed(label, at, "is not an object");
-    }
-    const components = readDeclarations(entry, "components", `${at}.components`, label) ?? [];
-    const bases = readDeclarations(entry, "bases", `${at}.bases`, label) ?? [];
-    const members = readStrings(entry, "members", `${at}.members`, label, 1);
-    if (members === undefined) {
-        throw malformed(label, `${at}.members`, "is required and names nothing");
-    }
-    if (components.length === 0 && bases.length === 0) {
-        throw malformed(label, at, 'names no declaration in "components" and no class in "bases", so it makes no class a component');
-    }
-    return { components, bases, members };
+function searched(named, document) {
+    return `${named} (${document === undefined ? "not present" : document.label})`;
 }
-/** The lifecycle contracts, one per framework the project declares. */
-function readLifecycleContracts(ts, label) {
-    const path = "ts.lifecycle_contracts";
-    const value = member(ts, "lifecycle_contracts");
-    if (value === undefined) {
-        return undefined;
+/** Sets the value at one dotted key of the resolved tree, whose sections the table lists first. */
+function setAt(tree, key, value) {
+    const names = key.split(".");
+    let into = tree;
+    for (const name of names.slice(0, -1)) {
+        into = into[name];
     }
-    if (!Array.isArray(value)) {
-        throw malformed(label, path, "is not an array");
-    }
-    return value.map((entry, index) => readLifecycleContract(entry, `${path}[${String(index)}]`, label));
-}
-/** One string member a provider entry requires, refused where it fails `pattern`. */
-function readMatching(entry, name, at, label, pattern) {
-    const path = `${at}.${name}`;
-    const value = requireMember(readString(entry, name, path, label), path, label);
-    if (!pattern.test(value)) {
-        throw malformed(label, path, `${JSON.stringify(value)} does not match ${pattern.source}`);
-    }
-    return value;
-}
-/**
- * One provider entry, read as the one shape its members name: a member only an
- * acquirable analyzer carries makes it acquirable, and then it carries all three.
- */
-function readProvider(entry, at, label) {
-    if (!isRecord(entry)) {
-        throw malformed(label, at, "is not an object");
-    }
-    const name = readMatching(entry, "name", at, label, ANALYZER_NAME);
-    const languages = readStrings(entry, "languages", `${at}.languages`, label, 1, LANGUAGES);
-    if (languages === undefined) {
-        throw malformed(label, `${at}.languages`, "is required and names nothing");
-    }
-    const commandPath = `${at}.command`;
-    const command = requireMember(readString(entry, "command", commandPath, label), commandPath, label);
-    if (!ACQUIRABLE_MEMBERS.some((member) => Object.hasOwn(entry, member))) {
-        return { shape: "installed", name, languages, command };
-    }
-    return {
-        shape: "acquirable",
-        name,
-        languages,
-        command,
-        source: readMatching(entry, "source", at, label, PROVIDER_SOURCE),
-        version: readMatching(entry, "version", at, label, PROVIDER_VERSION),
-        digest: readMatching(entry, "digest", at, label, PROVIDER_DIGEST),
-    };
-}
-/**
- * The provider list. Every file a run writes for an analyzer is keyed by the
- * entry's name, so a list naming one name twice is refused at the later entry.
- */
-function readProviders(providers, label) {
-    const path = "providers.analyzers";
-    const value = member(providers, "analyzers");
-    if (value === undefined) {
-        return undefined;
-    }
-    if (!Array.isArray(value)) {
-        throw malformed(label, path, "is not an array");
-    }
-    const read = value.map((entry, index) => readProvider(entry, `${path}[${String(index)}]`, label));
-    const first = new Map();
-    read.forEach((entry, index) => {
-        const earlier = first.get(entry.name);
-        if (earlier !== undefined) {
-            throw malformed(label, `${path}[${String(index)}].name`, `${JSON.stringify(entry.name)} is already the name of ${path}[${String(earlier)}], ` +
-                "and every entry's name keys the files a run writes for it");
-        }
-        first.set(entry.name, index);
-    });
-    return read;
+    into[names.at(-1) ?? key] = value;
 }
 /**
- * Reads one already-parsed configuration document as the settings it supplies,
- * refusing every constraint the closed key list declares that a parse cannot
- * express: a value of the wrong type, a value outside a closed set, an array that
- * repeats an entry or holds too few, and a count below its minimum.
+ * Every setting this analyzer reads, each from the highest-ranked source carrying it,
+ * else its default, in the closed key list's order. A setting with no default no
+ * source supplies is refused where its row is required and `enforce` holds, and left
+ * unset otherwise. A keyed section's members overlay its default's, member by member.
  */
-function readDoc(value, label) {
-    if (!isRecord(value)) {
-        throw malformed(label, "", "is not one JSON object");
-    }
-    const analysis = section(value, "analysis", "analysis", label);
-    const matrix = section(analysis, "matrix", "analysis.matrix", label);
-    const target = section(value, "target", "target", label);
-    const consumers = section(value, "consumers", "consumers", label);
-    const roots = section(value, "roots", "roots", label);
-    const reporters = section(value, "reporters", "reporters", label);
-    const providers = section(value, "providers", "providers", label);
-    const ts = section(value, "ts", "ts", label);
-    section(value, "go", "go", label);
-    section(value, "provenance", "provenance", label);
-    const contractVersion = readString(value, "contract_version", "contract_version", label);
-    if (contractVersion !== undefined && !CONTRACT_VERSION_PATTERN.test(contractVersion)) {
-        throw malformed(label, "contract_version", `${JSON.stringify(contractVersion)} is not a semantic version`);
-    }
-    return {
-        contractVersion,
-        targetKind: readTargetKind(target, label),
-        languages: readStrings(analysis, "languages", "analysis.languages", label, 0, LANGUAGES),
-        minConfidence: readEnum(analysis, "min_confidence", "analysis.min_confidence", label, CONFIDENCES),
-        generatedFiles: readEnum(analysis, "generated_files", "analysis.generated_files", label, GENERATED_FILES),
-        consumerTests: readEnum(analysis, "consumer_tests", "analysis.consumer_tests", label, CONSUMER_TESTS),
-        configurations: readConfigurations(analysis, label),
-        matrixComplete: readBoolean(matrix, "complete", "analysis.matrix.complete", label),
-        templateDirs: readStrings(analysis, "template_dirs", "analysis.template_dirs", label, 0),
-        templateDelimiters: readDelimiters(analysis, label),
-        consumersComplete: readBoolean(consumers, "complete", "consumers.complete", label),
-        rootPatterns: readStrings(roots, "patterns", "roots.patterns", label, 0),
-        severity: readSeverity(value, label),
-        exemptionsDisabled: readExemptions(value, label),
-        formats: readStrings(reporters, "formats", "reporters.formats", label, 1, FORMATS),
-        sort: readEnum(reporters, "sort", "reporters.sort", label, SORTS),
-        cascade: readEnum(reporters, "cascade", "reporters.cascade", label, CASCADES),
-        maxFindings: readCount(reporters, "max_findings", "reporters.max_findings", label),
-        failOn: readEnum(reporters, "fail_on", "reporters.fail_on", label, SEVERITIES),
-        providers: readProviders(providers, label),
-        testFiles: readStrings(ts, "test_files", "ts.test_files", label, 1),
-        entryFiles: readStrings(ts, "entry_files", "ts.entry_files", label, 0),
-        componentExtensions: readComponentExtensions(ts, label),
-        disabledConventions: readDisabledConventions(ts, label),
-        injectionRegistrations: readDeclarations(ts, "injection_registrations", "ts.injection_registrations", label),
-        lifecycleContracts: readLifecycleContracts(ts, label),
-        serializers: readDeclarations(ts, "serializers", "ts.serializers", label),
-        rootsComplete: readBoolean(ts, "roots_complete", "ts.roots_complete", label),
-    };
-}
-/** Parses one document's text and walks it against the closed key list. */
-function parseDocument(text, node, label) {
-    let value;
-    try {
-        value = JSON.parse(text);
+function settle(inputs, enforce) {
+    const sources = [];
+    if (inputs.flags !== undefined && inputs.flags.size > 0) {
+        sources.push(flagSource(inputs.flags));
     }
-    catch (error) {
-        throw malformed(label, "", error instanceof Error ? error.message : String(error));
+    if (inputs.repository !== undefined) {
+        sources.push(documentSource("repository", inputs.repository));
     }
-    checkDocument(text, node, label);
-    return value;
-}
-/** Names a document in a refusal: the path the invocation passed, or what it is. */
-function labelOr(label, named) {
-    return label === undefined || label === "" ? named : label;
-}
-/**
- * Decodes the documents one invocation supplies, in the order they outrank each
- * other, skipping every source it does not carry.
- */
-function readSources(inputs) {
-    const sources = [];
-    const flagLabels = inputs.flagLabels ?? new Map();
-    if (inputs.flags !== undefined) {
-        const flat = parseDocument(inputs.flags, { kind: "map" }, FLAGS_LABEL);
-        if (!isRecord(flat)) {
-            throw malformed(FLAGS_LABEL, "", "is not one JSON object");
-        }
-        sources.push({
-            doc: readDoc(nestFlags(flat, FLAGS_LABEL), FLAGS_LABEL),
-            kind: "flag",
-            label: "",
-            flagLabels,
-        });
+    if (inputs.central !== undefined) {
+        sources.push(documentSource("central", inputs.central));
     }
-    const held = [
-        {
-            kind: "repository",
-            named: "the repository configuration",
-            ...(inputs.repository === undefined ? {} : { text: inputs.repository }),
-            ...(inputs.repositoryLabel === undefined ? {} : { label: inputs.repositoryLabel }),
-        },
-        {
-            kind: "central",
-            named: "the central configuration",
-            ...(inputs.central === undefined ? {} : { text: inputs.central }),
-            ...(inputs.centralLabel === undefined ? {} : { label: inputs.centralLabel }),
-        },
-    ];
-    for (const entry of held) {
-        if (entry.text === undefined) {
+    const tree = {};
+    const provenance = new Map();
+    for (const row of SETTINGS) {
+        if (!row.read || row.role === "ignored") {
             continue;
         }
-        const label = labelOr(entry.label, entry.named);
-        sources.push({
-            doc: readDoc(parseDocument(entry.text, SCHEMA_ROOT, label), label),
-            kind: entry.kind,
-            label: entry.label ?? "",
-            flagLabels,
-        });
-    }
-    return sources;
-}
-/**
- * The value the highest-ranked source carrying one supplies, with where it came
- * from recorded, or the default.
- */
-function settle(fallback, path, provenance, sources, read) {
-    for (const source of sources) {
-        const value = read(source.doc);
-        if (value !== undefined) {
-            provenance.set(path, originOf(source, path));
-            return value;
-        }
-    }
-    provenance.set(path, { source: "default", label: "" });
-    return fallback;
-}
-/**
- * The severity object, resolved one code at a time so a code only the central
- * configuration names keeps its central value. An object that resolves empty
- * carries one entry for the object itself.
- */
-function settleSeverity(provenance, sources) {
-    const codes = new Set();
-    for (const source of sources) {
-        for (const code of source.doc.severity?.keys() ?? []) {
-            codes.add(code);
+        if (row.role === "section") {
+            setAt(tree, row.key, {});
         }
-    }
-    const severity = new Map();
-    for (const code of [...codes].sort()) {
-        const path = `${SEVERITY_SECTION}.${code}`;
-        for (const source of sources) {
-            const value = source.doc.severity?.get(code);
-            if (value === undefined) {
-                continue;
+        else if (row.role === "keyed") {
+            const members = isRecord(row.default) ? { ...row.default } : {};
+            provenance.set(row.key, { source: "default", label: "" });
+            for (const name of Object.keys(members)) {
+                provenance.set(`${row.key}.${name}`, { source: "default", label: "" });
             }
-            severity.set(code, value);
-            provenance.set(path, originOf(source, path));
-            break;
-        }
-    }
-    if (codes.size > 0) {
-        return severity;
-    }
-    provenance.set(SEVERITY_SECTION, { source: "default", label: "" });
-    for (const source of sources) {
-        if (source.doc.severity !== undefined) {
-            provenance.set(SEVERITY_SECTION, originOf(source, SEVERITY_SECTION));
-            break;
+            for (const held of sources.toReversed()) {
+                const named = held.supplied.keyed.get(row.key);
+                if (named === undefined) {
+                    continue;
+                }
+                provenance.set(row.key, originOf(held, row.key));
+                for (const [name, value] of Object.entries(named)) {
+                    members[name] = value;
+                    provenance.set(`${row.key}.${name}`, originOf(held, row.key));
+                }
+            }
+            if (Object.keys(members).length > 0) {
+                provenance.delete(row.key);
+            }
+            setAt(tree, row.key, canonical(members));
         }
-    }
-    return severity;
-}
-/** Names one configuration source and whether the invocation carried it. */
-function describeSource(named, text, label) {
-    if (text === undefined) {
-        return `${named} (not present)`;
-    }
-    return `${named} (${labelOr(label, "unnamed")})`;
-}
-/**
- * Refuses a provenance entry whose source names no file or flag, which would
- * print a provenance value the closed key list refuses to read back.
- */
-function checkLabels(provenance) {
-    for (const path of [...provenance.keys()].sort()) {
-        const origin = provenance.get(path);
-        if (origin !== undefined && origin.source !== "default" && origin.label === "") {
-            throw malformed(origin.source === "flag" ? FLAGS_LABEL : origin.source, path, `came from ${origin.source}, which names no file or flag`);
+        else {
+            const held = sources.find((one) => one.supplied.values.has(row.key));
+            if (held !== undefined) {
+                setAt(tree, row.key, held.supplied.values.get(row.key));
+                provenance.set(row.key, originOf(held, row.key));
+            }
+            else if (row.default !== undefined) {
+                setAt(tree, row.key, canonical(row.default));
+                provenance.set(row.key, { source: "default", label: "" });
+            }
+            else if (enforce && row.required === true) {
+                throw new UsageError(`${row.key} is not set, it has no default and is never inferred: searched ` +
+                    `${searched("the repository configuration", inputs.repository)} and ` +
+                    searched("the central configuration", inputs.central));
+            }
         }
     }
+    // gen-config.ts marks a member optional exactly where this loop may leave it unset.
+    return { config: tree, provenance };
 }
 /**
- * Applies a command-line flag over the repository configuration over the central
+ * Applies the command-line flags over the repository configuration over the central
  * configuration over the default each key declares, and returns the resolved
- * configuration with the origin of every setting.
- *
- * It throws a {@link ConfigError} for a document that names a key the closed key
- * list does not declare, a document that names one key twice, and a resolved
- * configuration no source supplied a target kind for. Every one of them maps to
- * the usage exit code.
+ * configuration with the origin of every setting: its keys in the closed key list's
+ * order, every object's members inside a value ascending. Every refusal is a
+ * {@link UsageError}.
  */
 export function resolve(inputs) {
-    const { config, provenance } = settleAll(inputs);
-    if (config.targetKind === "") {
-        throw new ConfigError("missing-target-kind", "target.kind", "target.kind is not set, it has no default and is never inferred: searched " +
-            `${describeSource("the repository configuration", inputs.repository, inputs.repositoryLabel)} and ` +
-            describeSource("the central configuration", inputs.central, inputs.centralLabel));
-    }
-    checkLabels(provenance);
-    return { config, provenance };
+    const { config, provenance } = settle(inputs, true);
+    return { config: config, provenance };
 }
 /**
- * The configuration the documents resolve to, every document read and refused as
- * {@link resolve} refuses it, with no target kind required of them: which projects a
- * run analyzes does not depend on the kind, so a question about the projects asks
- * none. The kind is empty where no document names one.
+ * The configuration the sources resolve to, refused as {@link resolve} refuses it but
+ * with no target kind required: which projects a run analyzes asks none.
  */
-export function resolveUnkinded(inputs) {
-    return settleAll(inputs).config;
-}
-/**
- * Every setting the documents supply, each from the highest-ranked source carrying
- * it, with the origin of each. The target kind is empty where no source names one.
- */
-function settleAll(inputs) {
-    const sources = readSources(inputs);
-    const defaults = defaultConfig();
-    const provenance = new Map();
-    const at = (path, fallback, read) => settle(fallback, path, provenance, sources, read);
-    const config = {
-        contractVersion: at("contract_version", defaults.contractVersion, (doc) => doc.contractVersion),
-        targetKind: at("target.kind", "", (doc) => doc.targetKind),
-        analysis: {
-            languages: at("analysis.languages", defaults.analysis.languages, (doc) => doc.languages),
-            minConfidence: at("analysis.min_confidence", defaults.analysis.minConfidence, (doc) => doc.minConfidence),
-            generatedFiles: at("analysis.generated_files", defaults.analysis.generatedFiles, (doc) => doc.generatedFiles),
-            consumerTests: at("analysis.consumer_tests", defaults.analysis.consumerTests, (doc) => doc.consumerTests),
-            configurations: at("analysis.configurations", defaults.analysis.configurations, (doc) => doc.configurations),
-            matrixComplete: at("analysis.matrix.complete", defaults.analysis.matrixComplete, (doc) => doc.matrixComplete),
-            templateDirs: at("analysis.template_dirs", defaults.analysis.templateDirs, (doc) => doc.templateDirs),
-            templateDelimiters: at("analysis.template_delimiters", defaults.analysis.templateDelimiters, (doc) => doc.templateDelimiters),
-        },
-        consumersComplete: at("consumers.complete", defaults.consumersComplete, (doc) => doc.consumersComplete),
-        rootPatterns: at("roots.patterns", defaults.rootPatterns, (doc) => doc.rootPatterns),
-        severity: settleSeverity(provenance, sources),
-        exemptionsDisabled: at("exemptions.disabled", defaults.exemptionsDisabled, (doc) => doc.exemptionsDisabled),
-        reporters: {
-            formats: at("reporters.formats", defaults.reporters.formats, (doc) => doc.formats),
-            sort: at("reporters.sort", defaults.reporters.sort, (doc) => doc.sort),
-            cascade: at("reporters.cascade", defaults.reporters.cascade, (doc) => doc.cascade),
-            maxFindings: at("reporters.max_findings", defaults.reporters.maxFindings, (doc) => doc.maxFindings),
-            failOn: at("reporters.fail_on", defaults.reporters.failOn, (doc) => doc.failOn),
-        },
-        providers: {
-            analyzers: at("providers.analyzers", defaults.providers.analyzers, (doc) => doc.providers),
-        },
-        ts: {
-            testFiles: at("ts.test_files", defaults.ts.testFiles, (doc) => doc.testFiles),
-            entryFiles: at("ts.entry_files", defaults.ts.entryFiles, (doc) => doc.entryFiles),
-            componentExtensions: at("ts.component_extensions", defaults.ts.componentExtensions, (doc) => doc.componentExtensions),
-            disabledConventions: at("ts.disabled_conventions", defaults.ts.disabledConventions, (doc) => doc.disabledConventions),
-            injectionRegistrations: at("ts.injection_registrations", defaults.ts.injectionRegistrations, (doc) => doc.injectionRegistrations),
-            lifecycleContracts: at("ts.lifecycle_contracts", defaults.ts.lifecycleContracts, (doc) => doc.lifecycleContracts),
-            serializers: at("ts.serializers", defaults.ts.serializers, (doc) => doc.serializers),
-            rootsComplete: at("ts.roots_complete", defaults.ts.rootsComplete, (doc) => doc.rootsComplete),
-        },
-    };
-    return { config, provenance };
+export function resolvePartial(inputs) {
+    return settle(inputs, false).config;
 }