@cyanheads/mcp-ts-core 0.13.4 → 0.13.6

package/AGENTS.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.13.4
+**Version:** 0.13.6
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0 (protocol revisions 2026-07-28 and 2025-*)
 **Zod:** ^4.6.5
@@ -247,7 +247,7 @@ export const myTool = tool('my_tool', {
 **`format`**: Maps output to MCP `content[]`. Different clients forward different surfaces to the agent — some (Claude Code) read `structuredContent` from `output`, others (Claude Desktop) read `content[]` from `format()`. `format()` is the markdown twin of `structuredContent`, not a reduced summary.
 
 - **Parity is lint-enforced.** Every terminal field in `output` must appear in `format()`'s rendered text (via sentinel injection), or the `format-parity` rule fails `bun run lint:mcp` / `devcheck`.
-- **Primary fix:** render the missing field in `format()`. Use `z.discriminatedUnion` for list/detail variants — each branch is validated separately.
+- **Primary fix:** render the missing field in `format()`. For list/detail variants, declare one flat `z.object` with a `kind` discriminator and presence-based optional arms, rendered by independent `if` blocks — `tool()` rejects a `z.discriminatedUnion` output root.
 - **Escape hatch:** if the schema was over-typed for a genuinely dynamic upstream API, relax it (`z.object({}).passthrough()`) — passthrough still flows data to `structuredContent`.
 - **Fallback:** omit `format` for JSON stringify. Additional formatters in `/utils`: `markdown()` (builder), `diffFormatter` (async), `tableFormatter`, `treeFormatter`.
 
@@ -378,7 +378,7 @@ See `api-context` skill for full details.
 
 ## Error Handling
 
-**Recommended path: declare a typed error contract.** Add `errors: [{ reason, code, when, recovery, retryable? }]` to `tool()` / `resource()`. Handler gets `ctx.fail(reason, msg?, data?)` typed against the reason union — typos fail at compile time. Runtime auto-populates `data.reason` for observability; linter enforces conformance against the handler body. `recovery` is required (≥5 words, lint-validated) — the single source of truth for the wire hint. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (framework mirrors `data.recovery.hint` into `content[]` text); override with explicit `{ recovery: { hint: '...' } }` when runtime context matters.
+**Recommended path: declare a typed error contract.** Add `errors: [{ reason, code, when, recovery, retryable?, severity?, thrownBy? }]` to `tool()` / `resource()`. Handler gets `ctx.fail(reason, msg?, data?)` typed against the reason union — typos fail at compile time. Runtime auto-populates `data.reason` for observability; linter enforces conformance against the handler body. `recovery` is required (≥5 words, lint-validated) — the single source of truth for the wire hint. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (framework mirrors `data.recovery.hint` into `content[]` text); override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Optional `severity` (`debug`/`info`/`notice`/`warning`) logs a modeled outcome below `error` — tools only, logging only: the wire envelope, the span status, and the `mcp.tool.*` metrics are untouched. Optional `thrownBy: 'service'` marks an entry the service layer produces, so `error-contract-unthrown` skips it while still checking the handler's own reasons — lint-only metadata, nothing at runtime reads it.
 
 ```ts
 errors: [
@@ -418,9 +418,9 @@ For HTTP responses from upstream APIs, use `httpErrorFromResponse(response, { se
 
 **Auto-classification.** Plain `Error`, `ZodError`, and any other thrown value are caught and classified automatically. Resolution order: request signal already aborted (→ `RequestCancelled`, outranking the thrown value's own code, `McpError` included) → `McpError` code (preserved as-is) → SDK `ConnectionClosed` (→ `RequestCancelled`) → JS constructor name (`TypeError` → `ValidationError`) → provider patterns (HTTP status codes, AWS errors, DB errors) → common message patterns → `AbortError` name (→ `Timeout`) → `InternalError` fallback.
 
-**Error-path parity.** Tool errors: `content[]` carries markdown with `data.recovery.hint`; `structuredContent.error` carries `{ code, message, data? }`. No `_meta.error`. Resources re-throw via JSON-RPC error envelope. An argument rejection is one of them: `-32602` with `data.issues`, plus `data.reason: 'invalid_arguments'` and a hint synthesized from the issues and the root schema — never a tool-declared `reason`, since the handler never ran.
+**Error-path parity.** Tool errors: `content[]` carries `Error: <message>`, then `Recovery: <hint>` when the hint says something the message does not already contain, then a closing `(reason … · not retryable)` for whichever of `data.reason` / `data.retryable` is present; the numeric code and `data.issues` stay JSON-only. `structuredContent.error` carries `{ code, message, data? }`. No `_meta.error`. Resources re-throw via JSON-RPC error envelope. An argument rejection is one of them: `-32602` with `data.issues`, plus `data.reason: 'invalid_arguments'` and a hint synthesized from the issues and the root schema — never a tool-declared `reason`, since the handler never ran. `client_capability_missing` is the second framework-owned reason: a `ctx.requestInput` return a 2025-era connection cannot serve is refused before any wire traffic as `-32600` carrying that reason and a hint naming the capability.
 
-**Lint rules** (all warnings, surfaced in `devcheck`): `prefer-mcp-error-in-handler`, `prefer-error-factory`, `preserve-cause-on-rethrow`, `no-stringify-upstream-error`, `error-contract-conformance`, `error-contract-prefer-fail`. See `api-linter` skill.
+**Lint rules** (all warnings, surfaced in `devcheck`): `prefer-mcp-error-in-handler`, `prefer-error-factory`, `preserve-cause-on-rethrow`, `no-stringify-upstream-error`, `error-contract-conformance`, `error-contract-prefer-fail`, `error-contract-unthrown` (a declared reason no literal `ctx.fail`/`ctx.recoveryFor` in the handler names, unless marked `thrownBy: 'service'`), `error-contract-recovery-unforwarded` (a `ctx.fail` site carrying neither `ctx.recoveryFor('<reason>')` nor its own `recovery` key, so the declared hint reaches neither client surface). See `api-linter` skill.
 
 See `api-errors` skill for the full pattern-matching table, error code reference, and detailed examples.
 

package/CLAUDE.md

@@ -1,7 +1,7 @@
 # Developer Protocol
 
 **Package:** `@cyanheads/mcp-ts-core`
-**Version:** 0.13.4
+**Version:** 0.13.6
 **Engines:** Bun ≥1.4.0, Node ≥24.0.0
 **MCP SDK:** `@modelcontextprotocol/server` ^2.0.0 (protocol revisions 2026-07-28 and 2025-*)
 **Zod:** ^4.6.5
@@ -247,7 +247,7 @@ export const myTool = tool('my_tool', {
 **`format`**: Maps output to MCP `content[]`. Different clients forward different surfaces to the agent — some (Claude Code) read `structuredContent` from `output`, others (Claude Desktop) read `content[]` from `format()`. `format()` is the markdown twin of `structuredContent`, not a reduced summary.
 
 - **Parity is lint-enforced.** Every terminal field in `output` must appear in `format()`'s rendered text (via sentinel injection), or the `format-parity` rule fails `bun run lint:mcp` / `devcheck`.
-- **Primary fix:** render the missing field in `format()`. Use `z.discriminatedUnion` for list/detail variants — each branch is validated separately.
+- **Primary fix:** render the missing field in `format()`. For list/detail variants, declare one flat `z.object` with a `kind` discriminator and presence-based optional arms, rendered by independent `if` blocks — `tool()` rejects a `z.discriminatedUnion` output root.
 - **Escape hatch:** if the schema was over-typed for a genuinely dynamic upstream API, relax it (`z.object({}).passthrough()`) — passthrough still flows data to `structuredContent`.
 - **Fallback:** omit `format` for JSON stringify. Additional formatters in `/utils`: `markdown()` (builder), `diffFormatter` (async), `tableFormatter`, `treeFormatter`.
 
@@ -378,7 +378,7 @@ See `api-context` skill for full details.
 
 ## Error Handling
 
-**Recommended path: declare a typed error contract.** Add `errors: [{ reason, code, when, recovery, retryable? }]` to `tool()` / `resource()`. Handler gets `ctx.fail(reason, msg?, data?)` typed against the reason union — typos fail at compile time. Runtime auto-populates `data.reason` for observability; linter enforces conformance against the handler body. `recovery` is required (≥5 words, lint-validated) — the single source of truth for the wire hint. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (framework mirrors `data.recovery.hint` into `content[]` text); override with explicit `{ recovery: { hint: '...' } }` when runtime context matters.
+**Recommended path: declare a typed error contract.** Add `errors: [{ reason, code, when, recovery, retryable?, severity?, thrownBy? }]` to `tool()` / `resource()`. Handler gets `ctx.fail(reason, msg?, data?)` typed against the reason union — typos fail at compile time. Runtime auto-populates `data.reason` for observability; linter enforces conformance against the handler body. `recovery` is required (≥5 words, lint-validated) — the single source of truth for the wire hint. Spread `ctx.recoveryFor('reason')` into `data` to opt the contract recovery onto the wire (framework mirrors `data.recovery.hint` into `content[]` text); override with explicit `{ recovery: { hint: '...' } }` when runtime context matters. Optional `severity` (`debug`/`info`/`notice`/`warning`) logs a modeled outcome below `error` — tools only, logging only: the wire envelope, the span status, and the `mcp.tool.*` metrics are untouched. Optional `thrownBy: 'service'` marks an entry the service layer produces, so `error-contract-unthrown` skips it while still checking the handler's own reasons — lint-only metadata, nothing at runtime reads it.
 
 ```ts
 errors: [
@@ -418,9 +418,9 @@ For HTTP responses from upstream APIs, use `httpErrorFromResponse(response, { se
 
 **Auto-classification.** Plain `Error`, `ZodError`, and any other thrown value are caught and classified automatically. Resolution order: request signal already aborted (→ `RequestCancelled`, outranking the thrown value's own code, `McpError` included) → `McpError` code (preserved as-is) → SDK `ConnectionClosed` (→ `RequestCancelled`) → JS constructor name (`TypeError` → `ValidationError`) → provider patterns (HTTP status codes, AWS errors, DB errors) → common message patterns → `AbortError` name (→ `Timeout`) → `InternalError` fallback.
 
-**Error-path parity.** Tool errors: `content[]` carries markdown with `data.recovery.hint`; `structuredContent.error` carries `{ code, message, data? }`. No `_meta.error`. Resources re-throw via JSON-RPC error envelope. An argument rejection is one of them: `-32602` with `data.issues`, plus `data.reason: 'invalid_arguments'` and a hint synthesized from the issues and the root schema — never a tool-declared `reason`, since the handler never ran.
+**Error-path parity.** Tool errors: `content[]` carries `Error: <message>`, then `Recovery: <hint>` when the hint says something the message does not already contain, then a closing `(reason … · not retryable)` for whichever of `data.reason` / `data.retryable` is present; the numeric code and `data.issues` stay JSON-only. `structuredContent.error` carries `{ code, message, data? }`. No `_meta.error`. Resources re-throw via JSON-RPC error envelope. An argument rejection is one of them: `-32602` with `data.issues`, plus `data.reason: 'invalid_arguments'` and a hint synthesized from the issues and the root schema — never a tool-declared `reason`, since the handler never ran. `client_capability_missing` is the second framework-owned reason: a `ctx.requestInput` return a 2025-era connection cannot serve is refused before any wire traffic as `-32600` carrying that reason and a hint naming the capability.
 
-**Lint rules** (all warnings, surfaced in `devcheck`): `prefer-mcp-error-in-handler`, `prefer-error-factory`, `preserve-cause-on-rethrow`, `no-stringify-upstream-error`, `error-contract-conformance`, `error-contract-prefer-fail`. See `api-linter` skill.
+**Lint rules** (all warnings, surfaced in `devcheck`): `prefer-mcp-error-in-handler`, `prefer-error-factory`, `preserve-cause-on-rethrow`, `no-stringify-upstream-error`, `error-contract-conformance`, `error-contract-prefer-fail`, `error-contract-unthrown` (a declared reason no literal `ctx.fail`/`ctx.recoveryFor` in the handler names, unless marked `thrownBy: 'service'`), `error-contract-recovery-unforwarded` (a `ctx.fail` site carrying neither `ctx.recoveryFor('<reason>')` nor its own `recovery` key, so the declared hint reaches neither client surface). See `api-linter` skill.
 
 See `api-errors` skill for the full pattern-matching table, error code reference, and detailed examples.
 

package/README.md

@@ -6,7 +6,7 @@
 
 <div align="center">
 
-[![Version](https://img.shields.io/badge/Version-0.13.4-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2026--07--28-8A2BE2.svg?style=flat-square)](https://modelcontextprotocol.io/specification/2026-07-28)
+[![Version](https://img.shields.io/badge/Version-0.13.6-blue.svg?style=flat-square)](./CHANGELOG.md) [![License](https://img.shields.io/badge/License-Apache%202.0-orange.svg?style=flat-square)](./LICENSE) [![MCP Spec](https://img.shields.io/badge/MCP%20Spec-2026--07--28-8A2BE2.svg?style=flat-square)](https://modelcontextprotocol.io/specification/2026-07-28)
 
 [![MCP SDK](https://img.shields.io/badge/MCP%20SDK-^2.0.0-green.svg?style=flat-square)](https://modelcontextprotocol.io/) [![TypeScript](https://img.shields.io/badge/TypeScript-^7.0.2-3178C6.svg?style=flat-square)](https://www.typescriptlang.org/) [![Bun](https://img.shields.io/badge/Bun-v1.4.0%2B-blueviolet.svg?style=flat-square)](https://bun.sh/)
 

package/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.5.13/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.14/schema.json",
   "vcs": {
     "enabled": true,
     "clientKind": "git",

package/changelog/0.13.x/0.13.5.md

@@ -0,0 +1,41 @@
+---
+summary: "Tool error text closes with the reason and retryable terms a caller branches on, a ctx.requestInput no 2025-era client capability can serve is refused with a real error envelope, an errors[] entry can declare a log severity below error, and a malformed canvas_id is an input error rather than an expired canvas."
+breaking: false
+security: false
+agent-notes: |
+  Three adoption steps for a consumer upgrading from 0.13.4.
+
+  1. A test pinning `content[0].text` exactly moves for any tool error whose
+     `data` carries a `reason` or a boolean `retryable` — the text now closes
+     with `(reason <reason> · not retryable)`. Assert containment instead.
+     `toolContractSuite`'s `^Error:` assertion is unaffected.
+  2. Declare a tool's `canvas_id` *input* field with `CanvasIdSchema` from
+     `@cyanheads/mcp-ts-core/canvas` (add your own `.describe()` naming the
+     producing tool). The *output* `canvas_id` stays a plain `z.string()`.
+  3. `error-contract-unthrown` is new and fires on the next `devcheck`: a
+     declared `errors[]` reason no literal `ctx.fail('<reason>'` in the handler
+     names. Wire the throw, or drop the entry.
+---
+
+# 0.13.5 — 2026-09-18
+
+## Added
+
+- **`severity` on an `errors[]` entry** ([#380](https://github.com/cyanheads/mcp-ts-core/issues/380)) — `debug`, `info`, `notice`, or `warning`, resolved against the thrown error's `data.reason`. It moves that one log record's level and adds `mcp.error.severity` to `mcp.errors.classified`; the wire envelope, the span status, and the `mcp.tool.*` counters are untouched. Tools only.
+- **`CanvasIdSchema`** from `/canvas` ([#327](https://github.com/cyanheads/mcp-ts-core/issues/327)) — the minted `^[A-Za-z0-9_-]{10}$` shape, for a tool's `canvas_id` *input* field so the constraint reaches `inputSchema` and an impossible value is rejected at argument validation.
+- **`errorHeaders` on `fetchWithTimeout` and `httpErrorFromResponse`** ([#302](https://github.com/cyanheads/mcp-ts-core/issues/302)) — an allowlist of response headers copied onto `error.data.headers` under lowercase keys on a non-2xx. Every selected value reaches the client, so never name a credential-bearing header; `set-cookie` is never captured.
+- **Lint rules `error-contract-unthrown` (warning) and `error-contract-severity-unknown` (error)** ([#290](https://github.com/cyanheads/mcp-ts-core/issues/290), [#380](https://github.com/cyanheads/mcp-ts-core/issues/380)) — a declared reason no literal `ctx.fail` / `ctx.recoveryFor` in the handler names, and a `severity` outside the four levels.
+
+## Changed
+
+- **Tool error `content[]` closes with `(reason … · not retryable)`** ([#458](https://github.com/cyanheads/mcp-ts-core/issues/458)) whenever `data.reason` is a non-empty string or `data.retryable` a boolean. The numeric code and `data.issues` stay JSON-only, and `structuredContent` is byte-identical to before.
+- **The `Recovery:` line is dropped when the trimmed message already contains the hint verbatim** ([#459](https://github.com/cyanheads/mcp-ts-core/issues/459)) — the case a constraint or refinement rejection produces, whose synthesized hint is the issue's own message. `structuredContent.error.data.recovery.hint` stays populated.
+- **The canvas tenant-cap refusal keeps `RateLimited` and names itself** ([#275](https://github.com/cyanheads/mcp-ts-core/issues/275)) — `data.reason: 'canvas_capacity_exhausted'`, `retryable: true`, and a hint leading with reusing a held `canvas_id`. `getErrorCategory` reads the error data alongside the code, so `mcp.tool.error_category` files it as `server` rather than `upstream`.
+- Skill versions: `add-tool` 2.27 → 2.28, `api-canvas` 2.2 → 2.3, `api-context` 2.4 → 2.5, `api-errors` 1.13 → 1.14, `api-linter` 1.15 → 1.16, `api-telemetry` 1.11 → 1.12, `api-utils` 2.10 → 2.11, `design-mcp-server` 2.27 → 2.28, `field-test` 2.15 → 2.16.
+
+## Fixed
+
+- **A `ctx.requestInput` the connection cannot serve fails with an error envelope** ([#379](https://github.com/cyanheads/mcp-ts-core/issues/379)) — on a 2025-era connection declaring no matching capability, `ctx.requestInput` throws `InvalidRequest` (`-32600`) with `data.reason: 'client_capability_missing'` and a hint naming `elicitation.form`, `elicitation.url`, `sampling.tools`, or `roots`, in place of the bare `isError` text block. A resource read gets the same code, reason, and hint instead of `-32603`. Still refused before any wire traffic; the 2026-07-28 leg is unchanged.
+- **The advertised `error.data.reason` description terminates each contract entry's `when`** ([#389](https://github.com/cyanheads/mcp-ts-core/issues/389)), so entries no longer run into each other or into the trailing sentence. Authored text is untouched — a `when` already ending in `.`, `?`, or `!` takes no second terminator.
+- **A malformed `canvas_id` is a `ValidationError`, not an expired canvas** ([#327](https://github.com/cyanheads/mcp-ts-core/issues/327)) — `data.reason: 'canvas_id_malformed'` before any registry lookup, on `acquire`, `drop` (which previously reported a silent `false`), and `importFrom`'s source id. A well-formed id that is missing, expired, or another tenant's keeps `canvas_not_found`.
+- **A 3xx maps to `InvalidRequest` rather than `InternalError`** ([#460](https://github.com/cyanheads/mcp-ts-core/issues/460)) — reachable under `redirect: 'manual'`, where `httpStatusToErrorCode` previously fell through to a code meaning *this* server failed. Outside `withRetry`'s transient set, since re-issuing returns the same redirect.

package/changelog/0.13.x/0.13.6.md

@@ -0,0 +1,49 @@
+---
+summary: "A ctx.fail site that never forwards its declared recovery now warns, an errors[] entry can mark itself thrownBy: 'service' so the unthrown rule skips it, capped-list-no-truncation stops firing on value bounds like max_depth_km, and devcheck.config.json can carry the truncation allowlist."
+breaking: false
+security: false
+agent-notes: |
+  Four adoption steps for a consumer upgrading from 0.13.5.
+
+  1. `error-contract-recovery-unforwarded` is new and fires on the next
+     `devcheck` / `lint:mcp`: a literal `ctx.fail('<reason>', …)` site carrying
+     neither `ctx.recoveryFor('<reason>')` nor its own `recovery` key. Clear it
+     by spreading `...ctx.recoveryFor('<reason>')` into the data argument, by
+     passing the resolver as that argument, or with an explicit
+     `recovery: { hint }` when the hint needs runtime context.
+  2. An `errors[]` reason the service layer produces takes `thrownBy: 'service'`,
+     which is what `error-contract-unthrown` reads to skip it. Prefer it over
+     moving the handler's literal `ctx.fail` out of scan range — that silences
+     the rule for the whole definition, handler-local reasons included.
+  3. Declare `lint.truncationAllowlist` in `devcheck.config.json` in place of
+     `MCP_LINT_TRUNCATION_ALLOWLIST` on each script entry, and drop the env var
+     from the `devcheck` and `lint:mcp` scripts once the key is in place. A
+     scaffolded config predating this release has no `lint` key; add it.
+  4. Drop any `truncationAllowlist` entry added only to silence
+     `capped-list-no-truncation` on a value-bound `max_*` input — those no
+     longer warn.
+---
+
+# 0.13.6 — 2026-09-19
+
+## Added
+
+- **Lint rule `error-contract-recovery-unforwarded`** (warning, [#255](https://github.com/cyanheads/mcp-ts-core/issues/255)) — one diagnostic per literal `ctx.fail('<reason>', …)` site carrying neither `ctx.recoveryFor('<reason>')` nor its own `recovery` key, so the declared hint reaches neither client surface. A site whose only resolver names a different reason warns too, naming both.
+- **`thrownBy: 'service'` on an `errors[]` entry** ([#462](https://github.com/cyanheads/mcp-ts-core/issues/462)) — lint-only metadata marking a reason produced below the handler, so `error-contract-unthrown` skips it while the handler's own reasons keep being checked. The entry stays typed, advertised, and thrown exactly as an unmarked one.
+- **`lint.truncationAllowlist` in `devcheck.config.json`** ([#388](https://github.com/cyanheads/mcp-ts-core/issues/388)) — read by `scripts/lint-mcp.ts` and forwarded as `LintInput.truncationAllowlist`, so one project-owned declaration covers every entrypoint that shells out to the linter. Takes an array of tool names or `false`; precedence is explicit `LintInput`, then the config file, then `MCP_LINT_TRUNCATION_ALLOWLIST`.
+
+## Changed
+
+- **The scaffold's `echo` tool forwards its declared recovery** ([#255](https://github.com/cyanheads/mcp-ts-core/issues/255)) — `templates/src/mcp-server/tools/definitions/echo.tool.ts` spreads `ctx.recoveryFor('empty_message')`, so a new server starts from the shape the rule asks for.
+- Skill versions: `add-service` 1.10 → 1.11, `add-tool` 2.28 → 2.29, `api-errors` 1.14 → 1.15, `api-linter` 1.16 → 1.17.
+
+## Fixed
+
+- **`capped-list-no-truncation`'s `max_` arm requires the counted noun to name a returned list** ([#345](https://github.com/cyanheads/mcp-ts-core/issues/345)) — a depth-0 array in `output` (plural-insensitive, a trailing `_count` stripped first) or a generic result container (`results`, `records`, `items`, `rows`, `hits`, `entries`, `matches`, `count`, `page`, `docs`). Value bounds (`max_depth_km`, `maxLat`, `max_date`) and work budgets (`max_court_lookups`, `maxCharacters`) stop warning; `limit`, `<noun>_limit`, and the page-size idioms are unchanged.
+- **`error-contract-unthrown` skips a definition whose `ctx.recoveryFor(` takes a non-literal first argument** ([#462](https://github.com/cyanheads/mcp-ts-core/issues/462)), as it already did for `ctx.fail(` — unknown reasons are in play either way. Its message now names all three fixes.
+- **The `format-parity` diagnostic no longer points authors at a `z.discriminatedUnion` output** ([#268](https://github.com/cyanheads/mcp-ts-core/issues/268)), which `tool()` rejects before any lint rule runs. The "Primary fix" line names a flat `z.object` with a `kind` discriminator and presence-based optional arms, rendered by independent `if` blocks.
+- **The `sanitizeHtml` event-handler property matches only inside a tag** ([#463](https://github.com/cyanheads/mcp-ts-core/issues/463)) — the whole-string `/\bon\w+\s*=/` also matched inert text such as `on0=`, failing roughly once in 300 runs. `on0=` and `<p>onclick=1</p>` are pinned as `examples`; the sanitizer itself is unchanged.
+
+## Dependencies
+
+- `@biomejs/biome` 2.5.13 → 2.5.14, `fast-check` ^4.10.0 → ^4.10.1.

package/dist/linter/rules/enrichment-rules.d.ts

@@ -45,10 +45,11 @@ export interface TruncationOptions {
 }
 /**
  * Warns when a tool takes a cap-like input field (`limit`, `per_page`,
- * `maxRecords`, … — see `isCapFieldName`) and returns an array output, but
- * declares no truncation disclosure — neither a
- * `truncated` key in its declared `enrichment` shape, nor `totalCount` in enrichment,
- * nor `truncated` or `totalCount` as top-level `output` keys.
+ * `maxRecords`, … — see `isCapFieldName`) that plausibly caps the returned list
+ * (see `capsTheList`) and returns an array output, but declares no truncation
+ * disclosure — neither a `truncated` key in its declared `enrichment` shape, nor
+ * `totalCount` in enrichment, nor `truncated` or `totalCount` as top-level
+ * `output` keys.
  *
  * The established `enrich.total()` convention (`totalCount`) and bespoke output fields
  * count as honest disclosure — the rule fires only on a genuinely silent cap.

package/dist/linter/rules/enrichment-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enrichment-rules.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/enrichment-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAkFtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CA0IlB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;CACrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EACC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3E,IAAI,GACJ,SAAS,EACb,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,cAAc,EAAE,CA4ClB"}
+{"version":3,"file":"enrichment-rules.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/enrichment-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAqJtE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAC/F,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CA0IlB;AAED,sDAAsD;AACtD,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;CACrD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EACC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAC3E,IAAI,GACJ,SAAS,EACb,iBAAiB,CAAC,EAAE,iBAAiB,GACpC,cAAc,EAAE,CAgDlB"}

package/dist/linter/rules/enrichment-rules.js

@@ -19,13 +19,60 @@ import { getCoreDefType, objectShape, objectShapeKeys, unwrapWrappers } from './
 /** Cap-like names that carry no `max`/`limit` morpheme and must be listed outright. */
 const CAP_FIELD_EXACT = new Set(['limit', 'per_page', 'page_size']);
 /**
- * True for a depth-0 input field name that caps how many items come back.
+ * Nouns that name a generic result container whatever the array is called, so a
+ * `max_<noun>` built on one of them caps the list even when nothing in `output`
+ * carries the same name — `maxRecords` against an `articles` array. Stored
+ * singular; the counted noun is singularized before the lookup, so the plural
+ * spellings (`results`, `records`, `items`, `rows`, `hits`, `entries`,
+ * `matches`, `docs`) resolve here too.
+ */
+const RESULT_CONTAINER_NOUNS = new Set([
+    'count',
+    'doc',
+    'entry',
+    'hit',
+    'item',
+    'match',
+    'page',
+    'record',
+    'result',
+    'row',
+]);
+/** camelCase → snake_case, lowercased, so `maxRecords` and `max_records` are one case. */
+function snakeCase(key) {
+    return key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+}
+/**
+ * Singularizes on a bounded suffix set — `articles` → `article`, `studies` →
+ * `study`, `matches` → `match`. Not a general English pluralizer: it only has to
+ * make an input's counted noun and an output array's name meet in the middle.
+ */
+function singularize(noun) {
+    if (noun.endsWith('ies'))
+        return `${noun.slice(0, -3)}y`;
+    if (/(?:s|x|ch|sh)es$/.test(noun))
+        return noun.slice(0, -2);
+    if (noun.endsWith('s') && !noun.endsWith('ss'))
+        return noun.slice(0, -1);
+    return noun;
+}
+/**
+ * The noun a `max_*` field counts: the name minus the `max_` prefix, minus a
+ * trailing `_count` (`max_result_count` → `result`), reduced to its last
+ * underscore segment and singularized.
+ */
+function countedNoun(key) {
+    const stem = snakeCase(key)
+        .replace(/^max_/, '')
+        .replace(/_count$/, '');
+    return singularize(stem.split('_').pop() ?? stem);
+}
+/**
+ * True for a depth-0 input field name that is cap-*shaped*.
  *
  * Matched by shape, not by an enumeration: an allowlist turns every new cap noun
  * (`maxRecords`, `maxRows`, `resultLimit`) into a silent gap where the rule never
- * runs at all, which is the same defect class the rule exists to catch. Both
- * naming conventions normalize to the same snake form first, so `maxRecords` and
- * `max_records` are one case.
+ * runs at all, which is the same defect class the rule exists to catch.
  *
  *   - `limit`, and any `<noun>_limit` / `<noun>Limit`
  *   - any `max_<noun>` / `max<Noun>`
@@ -34,17 +81,36 @@ const CAP_FIELD_EXACT = new Set(['limit', 'per_page', 'page_size']);
  * Deliberately NOT matched: bare `count`, `size`, `n`, `rows`, `records`, and
  * words that merely start with the letters (`maximum`).
  *
- * The shape cannot separate a cap on *how many* from an upper bound on a *value*,
- * so a range filter spelled `max_<noun>` (`max_magnitude`, `maxLat`, `max_date`)
- * matches as well. The rule still has to clear its other two conditions before it
- * says anything, and `truncationAllowlist` exempts a tool that trips it anyway.
+ * Shape alone cannot separate a cap on *how many* from an upper bound on a
+ * *value* or a budget on work done, so the `max_` arm is narrowed further by
+ * `capsTheList`.
  */
 function isCapFieldName(key) {
-    const normalized = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase();
+    const normalized = snakeCase(key);
     return (CAP_FIELD_EXACT.has(normalized) ||
         normalized.startsWith('max_') ||
         normalized.endsWith('_limit'));
 }
+/**
+ * True when a cap-shaped input field plausibly caps the returned list.
+ *
+ * `limit` / `<noun>_limit` / the page-size idioms say what they bound in the
+ * name itself and always qualify. `max_<noun>` does not: the same spelling
+ * carries value bounds (`max_depth_km`, `maxLat`, `max_date`) and budgets on
+ * secondary work (`max_court_lookups`, `maxCharacters`), none of which slice the
+ * array. So the counted noun has to name something the tool returns — a depth-0
+ * array in `output`, or a generic result container.
+ *
+ * Accepted false negative: a domain cap naming neither, `max_studies` against a
+ * `documents` array, goes silent. Nothing in the declaration separates it from a
+ * value bound, and `truncationAllowlist` only suppresses — it cannot re-enable.
+ */
+function capsTheList(key, arrayNouns) {
+    if (!snakeCase(key).startsWith('max_'))
+        return true;
+    const noun = countedNoun(key);
+    return RESULT_CONTAINER_NOUNS.has(noun) || arrayNouns.has(noun);
+}
 /**
  * Output field names that almost always indicate agent-facing context rather
  * than domain payload. Kept deliberately tiny to avoid false positives —
@@ -228,10 +294,11 @@ export function lintEnrichmentContract(def, definitionType, definitionName) {
 }
 /**
  * Warns when a tool takes a cap-like input field (`limit`, `per_page`,
- * `maxRecords`, … — see `isCapFieldName`) and returns an array output, but
- * declares no truncation disclosure — neither a
- * `truncated` key in its declared `enrichment` shape, nor `totalCount` in enrichment,
- * nor `truncated` or `totalCount` as top-level `output` keys.
+ * `maxRecords`, … — see `isCapFieldName`) that plausibly caps the returned list
+ * (see `capsTheList`) and returns an array output, but declares no truncation
+ * disclosure — neither a `truncated` key in its declared `enrichment` shape, nor
+ * `totalCount` in enrichment, nor `truncated` or `totalCount` as top-level
+ * `output` keys.
  *
  * The established `enrich.total()` convention (`totalCount`) and bespoke output fields
  * count as honest disclosure — the rule fires only on a genuinely silent cap.
@@ -251,12 +318,16 @@ export function lintCappedListTruncation(def, truncationOptions) {
     // per variant, so a cap in any branch counts — the rule asks whether the tool
     // can be capped at all, not whether every branch caps.
     const inputKeys = inputVariants(def.input).flatMap((variant) => objectShapeKeys(variant));
-    const capKeys = inputKeys.filter(isCapFieldName);
-    if (capKeys.length === 0)
+    const capShapedKeys = inputKeys.filter(isCapFieldName);
+    if (capShapedKeys.length === 0)
         return [];
-    // Check output for at least one array-typed field
-    const hasArrayOutput = hasTopLevelArray(def.output);
-    if (!hasArrayOutput)
+    // Check output for at least one array-typed field. The array names are also
+    // what a `max_<noun>` cap has to correlate with to count as a list cap.
+    const arrayNouns = topLevelArrayNouns(def.output);
+    if (arrayNouns.size === 0)
+        return [];
+    const capKeys = capShapedKeys.filter((key) => capsTheList(key, arrayNouns));
+    if (capKeys.length === 0)
         return [];
     // Check for truncation disclosure:
     // 1. Declared enrichment has `truncated` or `totalCount`
@@ -279,12 +350,18 @@ export function lintCappedListTruncation(def, truncationOptions) {
         },
     ];
 }
-/** True when the schema has at least one depth-0 field whose core Zod type is `array`. */
-function hasTopLevelArray(schema) {
+/**
+ * The singularized names of every depth-0 field whose core Zod type is `array`.
+ * Empty means the tool returns no list at all, which is the rule's array
+ * precondition; non-empty is also what a `max_<noun>` cap correlates against.
+ */
+function topLevelArrayNouns(schema) {
     const shape = objectShape(schema);
     if (!shape)
-        return false;
-    return Object.values(shape).some((field) => getCoreDefType(unwrapWrappers(field)) === 'array');
+        return new Set();
+    return new Set(Object.entries(shape)
+        .filter(([, field]) => getCoreDefType(unwrapWrappers(field)) === 'array')
+        .map(([key]) => singularize(snakeCase(key).split('_').pop() ?? key)));
 }
 /**
  * True when truncation is already disclosed — enrichment block has `truncated` or

package/dist/linter/rules/enrichment-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"enrichment-rules.js","sourceRoot":"","sources":["../../../src/linter/rules/enrichment-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEjG,uFAAuF;AACvF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5E,OAAO,CACL,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,MAAe;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA+F,EAC/F,cAAkC,EAClC,cAAsB;IAEtB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,yDAAyD;oBAC7F,0FAA0F;gBAC5F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5C,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,yBAAyB;oBAC/B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,mBAAmB,GAAG,4BAA4B;wBACtF,oFAAoF;wBACpF,wFAAwF;wBACxF,2FAA2F;wBAC3F,GAAG,GAAG,8BAA8B;oBACtC,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IACE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,GAAG,CAAC,UAAU,KAAK,IAAI;QACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC7B,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,cAAc,KAAK,cAAc,sFAAsF;YACnI,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAqC,CAAC,CAAC;IAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,wDAAwD;gBAC5F,gFAAgF;YAClF,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAChB,GAAG,CAAC,iBAAiB,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAChE,CAAC,CAAE,GAAG,CAAC,iBAAuF;QAC9F,CAAC,CAAC,SAAS,CAAC;IAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,yBAAyB;gBAChG,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,oCAAoC;oBAClG,mGAAmG;oBACnG,0FAA0F;gBAC5F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,mEAAmE;QACnE,IACE,WAAW,CAAC,MAAM,CAAC;YACnB,iBAAiB,CAAC,MAAM,CAAC;YACzB,CAAC,YAAY,CAAC,MAAM,CAAC;YACrB,OAAO,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAAU,EACjD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,uBAAuB;oBACrF,uFAAuF;oBACvF,yEAAyE;oBACzE,wBAAwB,GAAG,0DAA0D;oBACrF,wFAAwF;gBAC1F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,kCAAkC;oBACxC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,mCAAmC,GAAG,oBAAoB;wBAC9F,4EAA4E;oBAC9E,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAQD;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAGa,EACb,iBAAqC;IAErC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,yBAAyB;IACzB,IAAI,iBAAiB,EAAE,mBAAmB,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAEnE,kBAAkB;IAClB,MAAM,SAAS,GAAG,iBAAiB,EAAE,mBAAmB,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpE,6EAA6E;IAC7E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,kDAAkD;IAClD,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,CAAC;IAE/B,mCAAmC;IACnC,yDAAyD;IACzD,mEAAmE;IACnE,IAAI,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnE,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,SAAS,IAAI,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAClE,6FAA6F;gBAC7F,+FAA+F;gBAC/F,yGAAyG;gBACzG,oGAAoG;gBACpG,yFAAyF;gBACzF,uDAAuD;YACzD,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,IAAI;SACrB;KACF,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,SAAS,gBAAgB,CAAC,MAAe;IACvC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,UAAmB,EAAE,MAAe;IACnE,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpD,yBAAyB;IACzB,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAqC,CAAC,CAAC;QACtE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,qBAAqB;IACrB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"enrichment-rules.js","sourceRoot":"","sources":["../../../src/linter/rules/enrichment-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,yCAAyC,CAAC;AAExE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEjG,uFAAuF;AACvF,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAEzF;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,OAAO;IACP,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,0FAA0F;AAC1F,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC;SACxB,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CACL,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7B,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,UAA+B;IAC/D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjG,gFAAgF;AAChF,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,6FAA6F;AAC7F,SAAS,iBAAiB,CAAC,MAAe;IACxC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,IAAI,KAAK,SAAS,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAAe;IACnC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAA+F,EAC/F,cAAkC,EAClC,cAAsB;IAEtB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACxC,MAAM,WAAW,GAAqB,EAAE,CAAC;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAE/C,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACxC,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,yDAAyD;oBAC7F,0FAA0F;gBAC5F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC5C,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,yBAAyB;oBAC/B,QAAQ,EAAE,SAAS;oBACnB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,mBAAmB,GAAG,4BAA4B;wBACtF,oFAAoF;wBACpF,wFAAwF;wBACxF,2FAA2F;wBAC3F,GAAG,GAAG,8BAA8B;oBACtC,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IACE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;QAClC,GAAG,CAAC,UAAU,KAAK,IAAI;QACvB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAC7B,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,iBAAiB;YACvB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,GAAG,cAAc,KAAK,cAAc,sFAAsF;YACnI,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAqC,CAAC,CAAC;IAE1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,wDAAwD;gBAC5F,gFAAgF;YAClF,cAAc;YACd,cAAc;SACf,CAAC,CAAC;QACH,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,MAAM,YAAY,GAChB,GAAG,CAAC,iBAAiB,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QAChE,CAAC,CAAE,GAAG,CAAC,iBAAuF;QAC9F,CAAC,CAAC,SAAS,CAAC;IAEhB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,uBAAuB;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,yBAAyB;gBAChG,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,6BAA6B;gBACnC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,oCAAoC;oBAClG,mGAAmG;oBACnG,0FAA0F;gBAC5F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,uEAAuE;QACvE,mEAAmE;QACnE,IACE,WAAW,CAAC,MAAM,CAAC;YACnB,iBAAiB,CAAC,MAAM,CAAC;YACzB,CAAC,YAAY,CAAC,MAAM,CAAC;YACrB,OAAO,YAAY,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,UAAU,EACjD,CAAC;YACD,WAAW,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE,2BAA2B;gBACjC,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,uBAAuB,GAAG,uBAAuB;oBACrF,uFAAuF;oBACvF,yEAAyE;oBACzE,wBAAwB,GAAG,0DAA0D;oBACrF,wFAAwF;gBAC1F,cAAc;gBACd,cAAc;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,IAAI,YAAY,EAAE,CAAC;QACjB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,WAAW,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,kCAAkC;oBACxC,QAAQ,EAAE,OAAO;oBACjB,OAAO,EACL,GAAG,cAAc,KAAK,cAAc,mCAAmC,GAAG,oBAAoB;wBAC9F,4EAA4E;oBAC9E,cAAc;oBACd,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAQD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAGa,EACb,iBAAqC;IAErC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAExC,yBAAyB;IACzB,IAAI,iBAAiB,EAAE,mBAAmB,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAEnE,kBAAkB;IAClB,MAAM,SAAS,GAAG,iBAAiB,EAAE,mBAAmB,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpE,6EAA6E;IAC7E,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEpC,mCAAmC;IACnC,yDAAyD;IACzD,mEAAmE;IACnE,IAAI,uBAAuB,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IAEnE,OAAO;QACL;YACE,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,SAAS;YACnB,OAAO,EACL,SAAS,IAAI,+BAA+B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAClE,6FAA6F;gBAC7F,+FAA+F;gBAC/F,yGAAyG;gBACzG,oGAAoG;gBACpG,yFAAyF;gBACzF,uDAAuD;YACzD,cAAc,EAAE,MAAM;YACtB,cAAc,EAAE,IAAI;SACrB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAAe;IACzC,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC7B,OAAO,IAAI,GAAG,CACZ,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,OAAO,CAAC;SACxE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CACvE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,UAAmB,EAAE,MAAe;IACnE,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACpD,yBAAyB;IACzB,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/E,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,UAAqC,CAAC,CAAC;QACtE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvE,CAAC;IACD,qBAAqB;IACrB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/dist/linter/rules/error-contract-rules.d.ts

@@ -1,8 +1,9 @@
 /**
  * @fileoverview Lint rules for the declarative `errors[]` contract on tool and
- * resource definitions. Validates structure (codes, reasons), uniqueness,
- * and (when a contract is present) cross-checks handler bodies for thrown
- * codes that aren't declared.
+ * resource definitions. Validates structure (codes, reasons, severity),
+ * uniqueness, and — when a contract is present — cross-checks the handler body:
+ * codes thrown but not declared, reasons declared but never thrown, and throw
+ * sites that never put the declared `recovery` on the wire.
  * @module src/linter/rules/error-contract-rules
  */
 import type { LintDefinitionType, LintDiagnostic } from '../types.js';
@@ -16,6 +17,7 @@ import type { LintDefinitionType, LintDiagnostic } from '../types.js';
  *   - `recovery` is non-empty and ≥ 5 words (forcing function for thoughtful
  *     agent guidance — placeholders like "Try again." get flagged)
  *   - `retryable` (when present) is a boolean
+ *   - `severity` (when present) is one of the four levels below `error`
  */
 export declare function lintErrorContract(errors: unknown, definitionType: LintDefinitionType, definitionName: string): LintDiagnostic[];
 /**
@@ -46,4 +48,100 @@ export declare function lintErrorContractConformance(def: {
     handler?: unknown;
     errors?: unknown;
 }, definitionType: LintDefinitionType, definitionName: string): LintDiagnostic[];
+/** One literal `ctx.fail('<reason>', …)` (or `ctx.recoveryFor`) call site. */
+export interface ReasonCallSite {
+    /** Source offset just past the site's closing `)`. */
+    end: number;
+    /** The reason named by the site's first argument, read from the raw source. */
+    reason: string;
+    /** Source offset of the site's opening `(`. */
+    start: number;
+}
+/** What {@link scanReasonCalls} found for one callee in a handler's source. */
+export interface ReasonCallScan {
+    /**
+     * True when some call site took a non-literal first argument — a variable, a
+     * template literal, a map lookup. The set of reasons in play is then unknown.
+     */
+    indeterminate: boolean;
+    /** Every literal call site found, in source order. */
+    sites: ReasonCallSite[];
+}
+/**
+ * Finds every `<callee>('<literal>', …)` site in a handler's source, one record
+ * per site.
+ *
+ * Matching runs over the comment- and string-stripped text, which already
+ * excludes a call written inside a comment or nested in another literal. That
+ * transform blanks literal *contents* and keeps the quotes, so the reason
+ * survives only in the raw source — and it is length-preserving, so the same
+ * offsets address both. `tests/unit/linter/source-text.test.ts` asserts that
+ * alignment directly, since this rule depends on it.
+ *
+ * The span is carried so a rule that needs a site's arguments — not just which
+ * reason it names — can read them without rescanning.
+ */
+export declare function scanReasonCalls(source: string, callee: string): ReasonCallScan;
+/**
+ * Flags a declared `errors[]` reason that no code path in the handler can
+ * produce — the inverse of {@link lintErrorContractConformance}, which only
+ * catches codes thrown but not declared.
+ *
+ * A dead entry compiles, lints clean, and stays in the contract indefinitely;
+ * the typed `ctx.fail` union accepts the reason, so nothing downstream objects.
+ * The cost lands on the client, which plans for a failure mode the tool cannot
+ * produce while the mode it does produce goes undocumented.
+ *
+ * **Trigger.** Only when the handler holds at least one literal `ctx.fail(`. A
+ * handler with none produces its reasons somewhere the scan cannot reach, and
+ * firing there would warn on every service-layer definition. A `ctx.fail(` or
+ * `ctx.recoveryFor(` whose first argument is not a string literal makes the
+ * named set unknowable, so the whole definition is skipped rather than guessed
+ * at.
+ *
+ * **Warning, never error.** A reason produced outside the handler closure is
+ * invisible to any `toString()` scan, so the rule can never prove absence. An
+ * entry the service layer produces says so with `thrownBy: 'service'` and is
+ * skipped while the handler's own reasons keep being checked. Still silent
+ * without a marker: a `createFail(errors)` resolver built outside the handler,
+ * and an aliased `const fail = ctx.fail`.
+ */
+export declare function lintErrorContractUnthrown(def: {
+    handler?: unknown;
+    errors?: unknown;
+}, definitionType: LintDefinitionType, definitionName: string): LintDiagnostic[];
+/**
+ * Flags a literal `ctx.fail('<reason>', …)` site that does not put the
+ * contract's `recovery` on the wire.
+ *
+ * An `errors[]` entry must declare `recovery`, but reaching the client with it
+ * is opt-in: the throw site forwards `ctx.recoveryFor('<reason>')`, or passes
+ * its own `recovery` key. A site that does neither ships `reason` and
+ * `retryable` with no hint — and because the framework mirrors
+ * `data.recovery.hint` into the error `content[]`, both client surfaces lose it
+ * together. The declared guidance is right there in the contract and reaches
+ * nobody; an error-path test asserting `code` and `reason` passes either way.
+ *
+ * **Per site, not per reason.** A handler wiring one of six throws is covered
+ * at one of them, so each site is judged on its own argument list. Two sites
+ * naming one reason, one forwarding and one bare, produce exactly one
+ * diagnostic.
+ *
+ * **Accepted forms.** `{ ...ctx.recoveryFor('<reason>') }` spread into the data
+ * object, `ctx.recoveryFor('<reason>')` passed as the data argument, and an
+ * explicit `recovery` key carrying a runtime-interpolated hint.
+ *
+ * **Bails.** A non-literal first argument on either callee skips the whole
+ * definition — the reasons in play are unknown. A resolver sitting outside
+ * every fail span (a hoisted `const hint = ctx.recoveryFor('x')`) skips that
+ * reason, since the binding is assembled where the scan cannot follow it. A
+ * data argument the scan cannot read skips that one site.
+ *
+ * **Warning, never error.** A failure thrown below the handler is invisible to
+ * a `handler.toString()` scan, so the rule speaks only for the sites it sees.
+ */
+export declare function lintErrorContractRecoveryUnforwarded(def: {
+    handler?: unknown;
+    errors?: unknown;
+}, definitionType: LintDefinitionType, definitionName: string): LintDiagnostic[];
 //# sourceMappingURL=error-contract-rules.d.ts.map

package/dist/linter/rules/error-contract-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-contract-rules.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/error-contract-rules.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAetE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CAmLlB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5C,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CAiGlB"}
+{"version":3,"file":"error-contract-rules.d.ts","sourceRoot":"","sources":["../../../src/linter/rules/error-contract-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAuBtE;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,OAAO,EACf,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CAkMlB;AAyDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5C,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CAiGlB;AAMD,8EAA8E;AAC9E,MAAM,WAAW,cAAc;IAC7B,sDAAsD;IACtD,GAAG,EAAE,MAAM,CAAC;IACZ,+EAA+E;IAC/E,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;CACf;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sDAAsD;IACtD,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CA0B9E;AA6DD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5C,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CA4BlB;AA4DD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,oCAAoC,CAClD,GAAG,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5C,cAAc,EAAE,kBAAkB,EAClC,cAAc,EAAE,MAAM,GACrB,cAAc,EAAE,CA4ClB"}