@facilis.dev/analyze 0.0.0-stage → 0.1.0

package/src/passes/schema-file-links.ts

@@ -0,0 +1,213 @@
+/**
+ * `fileLinks(parent, { table, column })` -> the synthetic link table it generates (D-053).
+ *
+ * The call is framework DSL rather than a `pgTable(...)` literal, so the table pass cannot
+ * see the link table it returns. The options come from the static subset and the parent
+ * table from the declaring file's own drafts; a value the interpreter cannot read becomes an
+ * explicit unknown instead of aborting the pass.
+ */
+
+import { callArguments, identifierName, unwrapExpression, type AstNode } from "../ast/node.ts";
+import type { ModuleGraph, ProjectFile } from "../module-graph.ts";
+import type { StaticContext } from "../static-eval.ts";
+import type { Diagnostic, SourceRef, TableFact, UnknownFact } from "../types.ts";
+import { optionsOf } from "./schema-column-types.ts";
+import type { ColumnReference } from "./schema-columns.ts";
+import {
+  createDslResolver,
+  nodeRef,
+  schemaDiagnostics,
+  schemaUnknown,
+  topLevelDeclarators,
+} from "./schema-dsl.ts";
+import {
+  FACILIS_FILES_BINDING,
+  facilisFilesDraft,
+  linkColumns,
+  linkPolicies,
+} from "./schema-file-links-ddl.ts";
+import type { TableDraft } from "./schema-tables.ts";
+
+const DB_PACKAGE = "facilis-db";
+const FILE_LINKS = "fileLinks";
+const DEFAULT_PARENT_COLUMN = "parent_id";
+
+export interface FileLinkScan {
+  readonly drafts: readonly TableDraft[];
+  readonly diagnostics: readonly Diagnostic[];
+  /** Lookup-only targets of the generated FKs; see `facilisFilesDraft`. */
+  readonly externalTables: readonly TableDraft[];
+}
+
+interface LinkOptions {
+  /** null when the name is not a static non-empty string. */
+  readonly table: string | null;
+  readonly parentColumn: string;
+  readonly unknowns: readonly UnknownFact[];
+}
+
+function readOptions(
+  call: AstNode,
+  binding: string | null,
+  context: StaticContext,
+  source: SourceRef,
+): LinkOptions {
+  const label = binding ?? "unknown";
+  const options = optionsOf(callArguments(call)[1], context);
+  const unknowns: UnknownFact[] = [];
+  if (options === null) {
+    unknowns.push(
+      schemaUnknown('fileLinks options of "' + label + '" are not a static object', source),
+    );
+    return { table: null, parentColumn: DEFAULT_PARENT_COLUMN, unknowns };
+  }
+  const rawTable = options["table"];
+  let table: string | null = null;
+  if (typeof rawTable === "string" && rawTable.length > 0) {
+    table = rawTable;
+  } else {
+    unknowns.push(
+      schemaUnknown('fileLinks table name of "' + label + '" is not a static string', source),
+    );
+  }
+  const rawColumn = options["column"];
+  let parentColumn = DEFAULT_PARENT_COLUMN;
+  if (rawColumn !== undefined) {
+    if (typeof rawColumn === "string" && rawColumn.length > 0) {
+      parentColumn = rawColumn;
+    } else {
+      unknowns.push(
+        schemaUnknown('fileLinks column name of "' + label + '" is not a static string', source),
+      );
+    }
+  }
+  return { table, parentColumn, unknowns };
+}
+
+interface ParentTarget {
+  readonly binding: string;
+  readonly property: string;
+}
+
+function readParent(
+  call: AstNode,
+  drafts: readonly TableDraft[],
+  binding: string | null,
+  source: SourceRef,
+): { target: ParentTarget | null; unknowns: readonly UnknownFact[] } {
+  const label = binding ?? "unknown";
+  const parentNode = unwrapExpression(callArguments(call)[0]);
+  const parentBinding = parentNode?.type === "Identifier" ? identifierName(parentNode) : undefined;
+  if (parentBinding === undefined) {
+    return {
+      target: null,
+      unknowns: [schemaUnknown('fileLinks parent of "' + label + '" is not an identifier', source)],
+    };
+  }
+  const draft = drafts.find((entry) => entry.binding === parentBinding);
+  if (draft === undefined) {
+    return {
+      target: null,
+      unknowns: [
+        schemaUnknown(
+          'fileLinks parent "' + parentBinding + '" is not a table declared in this file',
+          source,
+        ),
+      ],
+    };
+  }
+  const key = draft.fact.primaryKey[0];
+  if (draft.fact.primaryKey.length !== 1 || key === undefined) {
+    return {
+      target: null,
+      unknowns: [
+        schemaUnknown(
+          'fileLinks parent "' + parentBinding + '" needs a single-column primary key',
+          source,
+        ),
+      ],
+    };
+  }
+  return { target: { binding: parentBinding, property: key }, unknowns: [] };
+}
+
+function buildLinkDraft(input: {
+  readonly call: AstNode;
+  readonly binding: string | null;
+  readonly drafts: readonly TableDraft[];
+  readonly context: StaticContext;
+  readonly source: SourceRef;
+}): { draft: TableDraft; external: TableDraft; unknowns: readonly UnknownFact[] } {
+  const { call, binding, drafts, context, source } = input;
+  const options = readOptions(call, binding, context, source);
+  const parent = readParent(call, drafts, binding, source);
+  const references: ColumnReference[] = [];
+  if (parent.target !== null) {
+    references.push({
+      column: "parentId",
+      target: {
+        binding: parent.target.binding,
+        property: parent.target.property,
+        onDelete: "cascade",
+        onUpdate: null,
+        source,
+      },
+    });
+  }
+  // The generated fileId column references facilis_files regardless of how the parent reads.
+  references.push({
+    column: "fileId",
+    target: {
+      binding: FACILIS_FILES_BINDING,
+      property: "id",
+      onDelete: "cascade",
+      onUpdate: null,
+      source,
+    },
+  });
+  const unknowns: UnknownFact[] = [...options.unknowns, ...parent.unknowns];
+  const fact: TableFact = {
+    name: options.table ?? binding ?? "unknown",
+    binding,
+    columns: linkColumns(options.parentColumn, source),
+    primaryKey: ["id"],
+    foreignKeys: [],
+    policies: linkPolicies(source),
+    rlsEnabled: true,
+    scope: { column: "tenantId", kind: "tenant" },
+    source,
+    unknown: unknowns,
+  };
+  return { draft: { fact, binding, references }, external: facilisFilesDraft(source), unknowns };
+}
+
+/** Read the top-level `fileLinks(...)` declarators of one schema file into table drafts. */
+export function collectFileLinkDrafts(
+  graph: ModuleGraph,
+  file: ProjectFile,
+  drafts: readonly TableDraft[],
+): FileLinkScan {
+  const resolver = createDslResolver(graph, file);
+  const context: StaticContext = { graph, file: file.path };
+  const links: TableDraft[] = [];
+  const externalTables: TableDraft[] = [];
+  const diagnostics: Diagnostic[] = [];
+  for (const declarator of topLevelDeclarators(file.program)) {
+    const binding = identifierName(declarator.id) ?? null;
+    const init = unwrapExpression(declarator.init);
+    if (init?.type !== "CallExpression") continue;
+    const symbol = resolver(init.callee);
+    if (symbol?.pkg !== DB_PACKAGE || symbol.name !== FILE_LINKS) continue;
+    const result = buildLinkDraft({
+      call: init,
+      binding,
+      drafts,
+      context,
+      source: nodeRef(file, init),
+    });
+    links.push(result.draft);
+    externalTables.push(result.external);
+    diagnostics.push(...schemaDiagnostics(result.unknowns));
+  }
+  return { drafts: links, externalTables, diagnostics };
+}

package/src/passes/schema-foreign-keys.ts

@@ -0,0 +1,121 @@
+import { diagnostic } from "../diagnostics.ts";
+import type { ModuleGraph } from "../module-graph.ts";
+import type { Diagnostic, ForeignKeyFact, TableFact } from "../types.ts";
+import type { TableDraft } from "./schema-tables.ts";
+
+export interface TableLookup {
+  /** `file#binding` -> table name; the key keeps same-named bindings in different modules apart. */
+  readonly byBinding: ReadonlyMap<string, string>;
+  readonly byName: ReadonlyMap<string, TableDraft>;
+}
+
+export function buildTableLookup(drafts: readonly TableDraft[]): TableLookup {
+  const byBinding = new Map<string, string>();
+  const byName = new Map<string, TableDraft>();
+  for (const draft of drafts) {
+    if (draft.binding !== null) {
+      byBinding.set(draft.fact.source.file + "#" + draft.binding, draft.fact.name);
+    }
+    byName.set(draft.fact.name, draft);
+  }
+  return { byBinding, byName };
+}
+
+/**
+ * Add lookups for tables a DSL call expands to but the analysis does not emit: a generated
+ * `fileLinks` FK points at the framework's `facilis_files`, whose source is absent from a
+ * release-ref map. The extra tables resolve FK targets only; they never reach `tables`.
+ */
+export function withFrameworkTables(
+  lookup: TableLookup,
+  tables: readonly TableDraft[],
+): TableLookup {
+  if (tables.length === 0) return lookup;
+  const byBinding = new Map(lookup.byBinding);
+  const byName = new Map(lookup.byName);
+  for (const table of tables) {
+    if (!byName.has(table.fact.name)) byName.set(table.fact.name, table);
+    if (table.binding === null) continue;
+    const key = table.fact.source.file + "#" + table.binding;
+    if (!byBinding.has(key)) byBinding.set(key, table.fact.name);
+  }
+  return { byBinding, byName };
+}
+
+/** Resolve a table identifier used in the DSL (local const or any project/framework import). */
+export function resolveTableBinding(
+  graph: ModuleGraph,
+  filePath: string,
+  local: string,
+  lookup: TableLookup,
+): string | null {
+  const binding = graph.resolveBinding(filePath, local);
+  if (binding !== null) {
+    const table = lookup.byBinding.get(binding.file + "#" + binding.name);
+    if (table !== undefined) return table;
+  }
+  return lookup.byBinding.get(filePath + "#" + local) ?? null;
+}
+
+export function finalizeTables(
+  graph: ModuleGraph,
+  drafts: readonly TableDraft[],
+  lookup: TableLookup,
+): { tables: TableFact[]; diagnostics: Diagnostic[] } {
+  const tables: TableFact[] = [];
+  const diagnostics: Diagnostic[] = [];
+  for (const draft of drafts) {
+    const foreignKeys: ForeignKeyFact[] = [];
+    for (const reference of draft.references) {
+      const table = draft.fact.name;
+      const targetTable = resolveTableBinding(
+        graph,
+        draft.fact.source.file,
+        reference.target.binding,
+        lookup,
+      );
+      if (targetTable === null) {
+        diagnostics.push(
+          diagnostic(
+            "fk-target-known",
+            "warning",
+            'table "' + table + '" references unknown table "' + reference.target.binding + '"',
+            reference.target.source,
+          ),
+        );
+        continue;
+      }
+      const targetDraft = lookup.byName.get(targetTable);
+      const knownColumn = targetDraft?.fact.columns.some(
+        (column) => column.property === reference.target.property,
+      );
+      if (knownColumn !== true) {
+        diagnostics.push(
+          diagnostic(
+            "fk-target-known",
+            "warning",
+            'table "' +
+              table +
+              '" references unknown column "' +
+              targetTable +
+              "." +
+              reference.target.property +
+              '"',
+            reference.target.source,
+          ),
+        );
+        continue;
+      }
+      foreignKeys.push({
+        columns: [reference.column],
+        targetTable,
+        targetColumns: [reference.target.property],
+        onDelete: reference.target.onDelete,
+        onUpdate: reference.target.onUpdate,
+        source: reference.target.source,
+      });
+    }
+    tables.push({ ...draft.fact, foreignKeys });
+  }
+  return { tables, diagnostics };
+}

package/src/passes/schema-policies.ts

@@ -0,0 +1,270 @@
+import {
+  callArguments,
+  identifierName,
+  memberName,
+  nodeArray,
+  unwrapExpression,
+  type AstNode,
+} from "../ast/node.ts";
+import type { ModuleGraph, ProjectFile } from "../module-graph.ts";
+import { staticString, type StaticContext } from "../static-eval.ts";
+import type { Diagnostic, PolicyCommand, PolicyFact, SourceRef, UnknownFact } from "../types.ts";
+import { optionsOf } from "./schema-column-types.ts";
+import {
+  callbackExpression,
+  nodeRef,
+  schemaDiagnostics,
+  schemaUnknown,
+  type DslResolver,
+  type DslSymbol,
+} from "./schema-dsl.ts";
+
+export interface PolicyInput {
+  readonly extras: AstNode | undefined;
+  readonly file: ProjectFile;
+  readonly graph: ModuleGraph;
+  readonly resolver: DslResolver;
+}
+
+export interface PolicyScan {
+  readonly policies: readonly PolicyFact[];
+  readonly diagnostics: readonly Diagnostic[];
+}
+
+const COMMANDS: Readonly<Record<string, PolicyCommand>> = {
+  select: "SELECT",
+  insert: "INSERT",
+  update: "UPDATE",
+  delete: "DELETE",
+  all: "ALL",
+};
+
+function scan(policies: readonly PolicyFact[]): PolicyScan {
+  return {
+    policies,
+    diagnostics: schemaDiagnostics(policies.flatMap((policy) => policy.unknown)),
+  };
+}
+
+function fixedPolicy(
+  name: string,
+  command: PolicyCommand,
+  restrictive: boolean,
+  source: SourceRef,
+  unknown: readonly UnknownFact[] = [],
+): PolicyFact {
+  return { name, command, restrictive, source, unknown };
+}
+
+function unknownPolicyScan(name: string, reason: string, source: SourceRef): PolicyScan {
+  const unknown = schemaUnknown(reason, source);
+  return {
+    policies: [{ name, command: "ALL", restrictive: false, source, unknown: [unknown] }],
+    diagnostics: schemaDiagnostics([unknown]),
+  };
+}
+
+function calleeLabel(callee: unknown): string {
+  const node = unwrapExpression(callee);
+  if (node === undefined) return "policy";
+  return identifierName(node) ?? memberName(node) ?? "policy";
+}
+
+function readPgPolicy(call: AstNode, context: StaticContext, file: ProjectFile): PolicyScan {
+  const source = nodeRef(file, call);
+  const args = callArguments(call);
+  const unknowns: UnknownFact[] = [];
+  let name = "unknown";
+  const nameResult = staticString(args[0], context);
+  if (nameResult.ok) {
+    name = nameResult.value;
+  } else {
+    unknowns.push(schemaUnknown("pgPolicy name is not a static string", source));
+  }
+  let command: PolicyCommand = "ALL";
+  let restrictive = false;
+  if (args[1] !== undefined) {
+    const options = optionsOf(args[1], context);
+    if (options === null) {
+      unknowns.push(schemaUnknown("pgPolicy options are not static", source));
+    } else {
+      const rawFor = options["for"];
+      if (rawFor !== undefined) {
+        const parsed = typeof rawFor === "string" ? (COMMANDS[rawFor.toLowerCase()] ?? null) : null;
+        if (parsed === null) {
+          unknowns.push(schemaUnknown('pgPolicy "for" is not a policy command', source));
+        } else {
+          command = parsed;
+        }
+      }
+      const rawAs = options["as"];
+      if (rawAs === "restrictive") {
+        restrictive = true;
+      } else if (rawAs !== undefined && rawAs !== "permissive") {
+        unknowns.push(schemaUnknown('pgPolicy "as" is not restrictive or permissive', source));
+      }
+    }
+  }
+  return scan([fixedPolicy(name, command, restrictive, source, unknowns)]);
+}
+
+/** `rlsForTable({...})` expands to the same policy set `@facilis.dev/db` builds at runtime. */
+function expandRlsTable(call: AstNode, context: StaticContext, file: ProjectFile): PolicyScan {
+  const source = nodeRef(file, call);
+  const args = callArguments(call);
+  let options: Record<string, unknown> = {};
+  if (args[0] !== undefined) {
+    const evaluated = optionsOf(args[0], context);
+    if (evaluated === null) {
+      const unknown = schemaUnknown("rlsForTable options are not static", source);
+      return {
+        policies: [fixedPolicy("tenant_isolation", "ALL", true, source, [unknown])],
+        diagnostics: schemaDiagnostics([unknown]),
+      };
+    }
+    options = evaluated;
+  }
+  const policies: PolicyFact[] = [fixedPolicy("tenant_isolation", "ALL", true, source)];
+  const ownerColumn = options["ownerColumn"];
+  if (Object.hasOwn(options, "ownerColumn")) {
+    const unknown =
+      typeof ownerColumn === "string"
+        ? []
+        : [schemaUnknown("rlsForTable ownerColumn is not a string", source)];
+    policies.push(fixedPolicy("owner_isolation", "ALL", false, source, unknown));
+  }
+  const rolesColumn = options["rolesColumn"];
+  if (Object.hasOwn(options, "rolesColumn")) {
+    const unknown =
+      typeof rolesColumn === "string"
+        ? []
+        : [schemaUnknown("rlsForTable rolesColumn is not a string", source)];
+    policies.push(fixedPolicy("role_access", "ALL", false, source, unknown));
+  }
+  return scan(policies);
+}
+
+function readRlsExpansion(
+  node: AstNode | undefined,
+  context: StaticContext,
+  file: ProjectFile,
+  resolver: DslResolver,
+): PolicyScan | null {
+  if (node === undefined) return null;
+  let call: AstNode | undefined;
+  if (node.type === "CallExpression") {
+    call = node;
+  } else if (node.type === "MemberExpression" && memberName(node) === "policies") {
+    const object = unwrapExpression(node.object);
+    if (object?.type === "CallExpression") call = object;
+  }
+  if (call === undefined) return null;
+  const symbol: DslSymbol | null = resolver(call.callee);
+  if (
+    symbol?.pkg !== "facilis-db" ||
+    (symbol.name !== "rlsForTable" && symbol.name !== "withRls")
+  ) {
+    return null;
+  }
+  return expandRlsTable(call, context, file);
+}
+
+function readPolicyEntry(
+  element: AstNode,
+  context: StaticContext,
+  file: ProjectFile,
+  resolver: DslResolver,
+): PolicyScan {
+  const node = unwrapExpression(element);
+  const source = nodeRef(file, node ?? element);
+  const expansion = readRlsExpansion(node, context, file, resolver);
+  if (expansion !== null) return expansion;
+  if (node?.type !== "CallExpression") {
+    return unknownPolicyScan("policy", "table extras entry is not a policy call", source);
+  }
+  const symbol = resolver(node.callee);
+  if (symbol?.pkg === "facilis-db") {
+    if (symbol.name === "tenantIsolationPolicy") {
+      return scan([fixedPolicy("tenant_isolation", "ALL", true, source)]);
+    }
+    if (symbol.name === "ownerIsolationPolicy") {
+      return scan([fixedPolicy("owner_isolation", "ALL", false, source)]);
+    }
+    if (symbol.name === "rolePolicy") {
+      const args = callArguments(node);
+      const unknowns: UnknownFact[] = [];
+      let name = "role_access";
+      if (args[1] !== undefined) {
+        const evaluated = staticString(args[1], context);
+        if (evaluated.ok) {
+          name = evaluated.value;
+        } else {
+          unknowns.push(schemaUnknown("rolePolicy name is not a static string", source));
+        }
+      }
+      return scan([fixedPolicy(name, "ALL", false, source, unknowns)]);
+    }
+  }
+  if (symbol?.pkg === "pg-core" && symbol.name === "pgPolicy") {
+    return readPgPolicy(node, context, file);
+  }
+  return unknownPolicyScan(
+    calleeLabel(node.callee),
+    'policy helper "' + calleeLabel(node.callee) + '" is outside the documented DSL',
+    source,
+  );
+}
+
+function readPolicies(
+  expression: AstNode,
+  context: StaticContext,
+  file: ProjectFile,
+  resolver: DslResolver,
+): PolicyScan {
+  const node = unwrapExpression(expression);
+  if (node === undefined) {
+    return unknownPolicyScan(
+      "policy",
+      "table extras are not a policy expression",
+      nodeRef(file, expression),
+    );
+  }
+  if (node.type === "ArrayExpression") {
+    const policies: PolicyFact[] = [];
+    const diagnostics: Diagnostic[] = [];
+    for (const element of nodeArray(node, "elements")) {
+      const spreadArgument =
+        element.type === "SpreadElement" ? unwrapExpression(element.argument) : undefined;
+      const nested =
+        element.type === "SpreadElement"
+          ? spreadArgument === undefined
+            ? unknownPolicyScan(
+                "policy",
+                "spread policy entry is not an expression",
+                nodeRef(file, element),
+              )
+            : readPolicies(spreadArgument, context, file, resolver)
+          : readPolicyEntry(element, context, file, resolver);
+      policies.push(...nested.policies);
+      diagnostics.push(...nested.diagnostics);
+    }
+    return { policies, diagnostics };
+  }
+  const expansion = readRlsExpansion(node, context, file, resolver);
+  if (expansion !== null) return expansion;
+  return readPolicyEntry(node, context, file, resolver);
+}
+
+export function buildPolicyFacts(input: PolicyInput): PolicyScan {
+  if (input.extras === undefined) return { policies: [], diagnostics: [] };
+  const expression = callbackExpression(input.extras);
+  if (expression === undefined) {
+    return unknownPolicyScan(
+      "policy",
+      "table extras are not a readable callback",
+      nodeRef(input.file, input.extras),
+    );
+  }
+  const context: StaticContext = { graph: input.graph, file: input.file.path };
+  return readPolicies(expression, context, input.file, input.resolver);
+}

package/src/passes/schema-re-exports.ts

@@ -0,0 +1,95 @@
+import { diagnostic } from "../diagnostics.ts";
+import type { ModuleGraph, ProjectFile } from "../module-graph.ts";
+import { identifierName, literalString, nodeArray } from "../ast/node.ts";
+import type { Diagnostic, ConfigFacts } from "../types.ts";
+import { nodeRef } from "./schema-dsl.ts";
+import { collectTableDrafts, type TableDraft, type TableScan } from "./schema-tables.ts";
+
+/** Merge the tables of `export { users } from "@facilis.dev/auth"` (framework source, recursively). */
+export function collectReExportedDrafts(
+  graph: ModuleGraph,
+  file: ProjectFile,
+  config: ConfigFacts,
+  seenNames: Set<string>,
+  visitedFiles: Set<string>,
+): TableScan {
+  const drafts: TableDraft[] = [];
+  const diagnostics: Diagnostic[] = [];
+  for (const statement of nodeArray(file.program, "body")) {
+    const hasSource =
+      statement.type === "ExportNamedDeclaration" || statement.type === "ExportAllDeclaration";
+    const specifier = hasSource ? literalString(statement.source) : undefined;
+    if (specifier === undefined) continue;
+    const targetPath = graph.resolve(file.path, specifier);
+    const target = targetPath === null ? undefined : graph.file(targetPath);
+    if (target === undefined) {
+      diagnostics.push(
+        diagnostic(
+          "unknown",
+          "info",
+          'cannot resolve re-exported module "' + specifier + '"',
+          nodeRef(file, statement),
+        ),
+      );
+      continue;
+    }
+    if (visitedFiles.has(target.path)) continue;
+    visitedFiles.add(target.path);
+    const local = collectTableDrafts(graph, target, config);
+    diagnostics.push(...local.diagnostics);
+    for (const draft of local.drafts) {
+      if (seenNames.has(draft.fact.name)) continue;
+      seenNames.add(draft.fact.name);
+      drafts.push(draft);
+    }
+    const nested = collectReExportedDrafts(graph, target, config, seenNames, visitedFiles);
+    drafts.push(...nested.drafts);
+    diagnostics.push(...nested.diagnostics);
+  }
+
+  // The example project imports framework tables and re-exports the local bindings:
+  //   import { users } from "@facilis.dev/auth"; export { users };
+  // Follow the import, keep only the tables whose binding was re-exported.
+  for (const statement of nodeArray(file.program, "body")) {
+    if (
+      statement.type !== "ExportNamedDeclaration" ||
+      literalString(statement.source) !== undefined
+    )
+      continue;
+    for (const item of nodeArray(statement, "specifiers")) {
+      if (item.type !== "ExportSpecifier") continue;
+      const local = identifierName(item.local);
+      if (local === undefined) continue;
+      const imported = file.module.imports.find((entry) => entry.local === local);
+      if (imported === undefined) continue;
+      const targetPath = graph.resolve(file.path, imported.specifier);
+      const target = targetPath === null ? undefined : graph.file(targetPath);
+      if (target === undefined) {
+        diagnostics.push(
+          diagnostic(
+            "unknown",
+            "info",
+            'cannot resolve re-exported module "' + imported.specifier + '"',
+            nodeRef(file, item),
+          ),
+        );
+        continue;
+      }
+      if (visitedFiles.has(target.path)) continue;
+      visitedFiles.add(target.path);
+      const localScan = collectTableDrafts(graph, target, config);
+      diagnostics.push(...localScan.diagnostics);
+      for (const draft of localScan.drafts) {
+        const importedName = imported.imported ?? local;
+        if (draft.binding !== importedName && draft.fact.name !== importedName) continue;
+        if (seenNames.has(draft.fact.name)) continue;
+        seenNames.add(draft.fact.name);
+        drafts.push(draft);
+      }
+      const nested = collectReExportedDrafts(graph, target, config, seenNames, visitedFiles);
+      drafts.push(...nested.drafts);
+      diagnostics.push(...nested.diagnostics);
+    }
+  }
+  return { drafts, diagnostics };
+}