@invinite-org/chartlang-compiler 1.2.1 → 1.3.0

package/dist/analysis/extractRequestedIntervals.js

@@ -2,34 +2,119 @@
 // See the LICENSE file in the repo root for full license text.
 import ts from "typescript";
 import { createDiagnostic } from "../diagnostics.js";
+import { callsiteIdFor } from "../transformers/callsiteIdInjection.js";
 import { resolveCalleeName } from "../transformers/resolveCallee.js";
+import { validateSecurityExpr } from "./validateSecurityExpr.js";
 /**
  * Walk a script's AST and collect every static `interval` argument to
- * `request.security({ interval: ... })` and `request.lowerTf(...)`. Dynamic
- * arguments emit `request-security-interval-not-literal` (for `request.security`)
- * or `request-lower-tf-interval-not-literal` (for `request.lowerTf`) and are
- * excluded.
+ * `request.security({ interval: ... })` and `request.lowerTf(...)`, plus every
+ * `request.security` *expression* callsite (a second arrow/function argument).
+ * Dynamic intervals emit `request-security-interval-not-literal` (for
+ * `request.security`) or `request-lower-tf-interval-not-literal` (for
+ * `request.lowerTf`) and are excluded.
  *
- * @since 0.4
+ * Each expression callsite is recorded as a {@link SecurityExpressionDescriptor}
+ * keyed by the same `slotId` the callsite-id transformer injects (via the
+ * shared `callsiteIdFor` helper) so the runtime can match the manifest entry
+ * to the inlined callback. When `validateExpressions` is `true`, each callback
+ * is also run through {@link validateSecurityExpr}, pushing
+ * `request-security-expr-captures-local` for any out-of-subset reference.
+ *
+ * @since 0.7
+ * @stable
  * @example
- *     // const intervals = extractRequestedIntervals(sf, checker, inputs, diagnostics);
- *     // intervals === ["1D", "5m"];
- *     const fn: typeof extractRequestedIntervals = extractRequestedIntervals;
+ *     // const { intervals, securityExpressions } =
+ *     //     extractRequestAnalysis(sf, checker, inputs, diagnostics, path, true);
+ *     const fn: typeof extractRequestAnalysis = extractRequestAnalysis;
  *     void fn;
  */
-export function extractRequestedIntervals(sourceFile, checker, inputs, diagnostics, sourcePath = sourceFile.fileName) {
+export function extractRequestAnalysis(sourceFile, checker, inputs, diagnostics, sourcePath = sourceFile.fileName, validateExpressions = false) {
     const intervals = new Set();
+    const securityExpressions = [];
     const visit = (node) => {
         if (ts.isCallExpression(node)) {
             const calleeName = resolveCalleeName(node, checker);
             if (calleeName === "request.security" || calleeName === "request.lowerTf") {
                 readRequestInterval(node, calleeName, sourceFile, sourcePath, inputs, diagnostics, intervals);
             }
+            if (calleeName === "request.security") {
+                readSecurityExpression(node, sourceFile, sourcePath, checker, diagnostics, validateExpressions, securityExpressions);
+            }
         }
         ts.forEachChild(node, visit);
     };
     ts.forEachChild(sourceFile, visit);
-    return Object.freeze(Array.from(intervals).sort());
+    securityExpressions.sort((a, b) => a.slotId.localeCompare(b.slotId));
+    return Object.freeze({
+        intervals: Object.freeze(Array.from(intervals).sort()),
+        securityExpressions: Object.freeze(securityExpressions.slice()),
+    });
+}
+/**
+ * Walk a script's AST and collect every static `interval` argument to
+ * `request.security({ interval: ... })` and `request.lowerTf(...)`. Dynamic
+ * arguments emit `request-security-interval-not-literal` (for `request.security`)
+ * or `request-lower-tf-interval-not-literal` (for `request.lowerTf`) and are
+ * excluded. Thin delegate over {@link extractRequestAnalysis} kept for callers
+ * that only need the interval list.
+ *
+ * @since 0.4
+ * @example
+ *     // const intervals = extractRequestedIntervals(sf, checker, inputs, diagnostics);
+ *     // intervals === ["1D", "5m"];
+ *     const fn: typeof extractRequestedIntervals = extractRequestedIntervals;
+ *     void fn;
+ */
+export function extractRequestedIntervals(sourceFile, checker, inputs, diagnostics, sourcePath = sourceFile.fileName) {
+    return extractRequestAnalysis(sourceFile, checker, inputs, diagnostics, sourcePath).intervals;
+}
+/**
+ * Detect and record a `request.security` expression callsite — a second
+ * argument that is an arrow or function expression. Mints the descriptor's
+ * `slotId` via `callsiteIdFor` (lockstep with the injector), reads the literal
+ * `interval` and the callback's single parameter name, and — when
+ * `validate` — runs the capture check. A callsite whose interval is not a
+ * compile-time literal already emitted `request-security-interval-not-literal`
+ * via `readRequestInterval`; it is skipped here (no descriptor).
+ */
+function readSecurityExpression(call, sourceFile, sourcePath, checker, diagnostics, validate, out) {
+    const callback = call.arguments[1];
+    if (callback === undefined ||
+        !(ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))) {
+        return;
+    }
+    if (validate) {
+        validateSecurityExpr(callback, checker, diagnostics, sourcePath);
+    }
+    const interval = readLiteralInterval(call);
+    if (interval === null)
+        return;
+    const firstParam = callback.parameters[0];
+    const paramName = firstParam !== undefined && ts.isIdentifier(firstParam.name) ? firstParam.name.text : "";
+    out.push(Object.freeze({
+        slotId: callsiteIdFor(sourceFile, call, sourcePath),
+        interval,
+        paramName,
+    }));
+}
+/**
+ * Read the literal `interval` string off a `request.security` call's opts
+ * object, or `null` when it is absent or non-literal. Only string-literal
+ * intervals key an expression unit; an `input.enum` interval expands to
+ * multiple intervals for the requested-interval list but cannot anchor a
+ * single expression clock, so it is treated as non-literal here.
+ */
+function readLiteralInterval(call) {
+    const opts = call.arguments[0];
+    if (opts === undefined || !ts.isObjectLiteralExpression(opts))
+        return null;
+    const intervalProperty = opts.properties
+        .filter(ts.isPropertyAssignment)
+        .find((property) => ts.isIdentifier(property.name) && property.name.text === "interval");
+    if (intervalProperty === undefined)
+        return null;
+    const initializer = intervalProperty.initializer;
+    return ts.isStringLiteral(initializer) ? initializer.text : null;
 }
 function readRequestInterval(call, calleeName, sourceFile, sourcePath, inputs, diagnostics, intervals) {
     const opts = call.arguments[0];

package/dist/analysis/extractRequestedIntervals.js.map

@@ -1 +1 @@
-{"version":3,"file":"extractRequestedIntervals.js","sourceRoot":"","sources":["../../src/analysis/extractRequestedIntervals.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAA0B,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAGrE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACrC,UAAyB,EACzB,OAAuB,EACvB,MAAqD,EACrD,WAAgC,EAChC,aAAqB,UAAU,CAAC,QAAQ;IAExC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpD,IAAI,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;gBACxE,mBAAmB,CACf,IAAI,EACJ,UAAU,EACV,UAAU,EACV,UAAU,EACV,MAAM,EACN,WAAW,EACX,SAAS,CACZ,CAAC;YACN,CAAC;QACL,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CACxB,IAAuB,EACvB,UAAkD,EAClD,UAAyB,EACzB,UAAkB,EAClB,MAAqD,EACrD,WAAgC,EAChC,SAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;SACnC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC7F,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAE3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;IACjD,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,WAAW;YAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;IACX,CAAC;IAED,WAAW,CAAC,IAAI,CACZ,gBAAgB,CAAC;QACb,QAAQ,EAAE,OAAO;QACjB,IAAI,EACA,UAAU,KAAK,iBAAiB;YAC5B,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,uCAAuC;QACjD,OAAO,EAAE,GAAG,UAAU,6DAA6D;QACnF,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,UAAU;KACb,CAAC,CACL,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CACzB,IAAmB,EACnB,MAAqD;IAErD,IACI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QACpC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EACnC,CAAC;QACC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nimport ts from \"typescript\";\n\nimport { type CompileDiagnostic, createDiagnostic } from \"../diagnostics.js\";\nimport { resolveCalleeName } from \"../transformers/resolveCallee.js\";\nimport type { ExtractedDescriptor } from \"./extractInputs.js\";\n\n/**\n * Walk a script's AST and collect every static `interval` argument to\n * `request.security({ interval: ... })` and `request.lowerTf(...)`. Dynamic\n * arguments emit `request-security-interval-not-literal` (for `request.security`)\n * or `request-lower-tf-interval-not-literal` (for `request.lowerTf`) and are\n * excluded.\n *\n * @since 0.4\n * @example\n *     // const intervals = extractRequestedIntervals(sf, checker, inputs, diagnostics);\n *     // intervals === [\"1D\", \"5m\"];\n *     const fn: typeof extractRequestedIntervals = extractRequestedIntervals;\n *     void fn;\n */\nexport function extractRequestedIntervals(\n    sourceFile: ts.SourceFile,\n    checker: ts.TypeChecker,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n    diagnostics: CompileDiagnostic[],\n    sourcePath: string = sourceFile.fileName,\n): ReadonlyArray<string> {\n    const intervals = new Set<string>();\n\n    const visit = (node: ts.Node): void => {\n        if (ts.isCallExpression(node)) {\n            const calleeName = resolveCalleeName(node, checker);\n            if (calleeName === \"request.security\" || calleeName === \"request.lowerTf\") {\n                readRequestInterval(\n                    node,\n                    calleeName,\n                    sourceFile,\n                    sourcePath,\n                    inputs,\n                    diagnostics,\n                    intervals,\n                );\n            }\n        }\n        ts.forEachChild(node, visit);\n    };\n\n    ts.forEachChild(sourceFile, visit);\n    return Object.freeze(Array.from(intervals).sort());\n}\n\nfunction readRequestInterval(\n    call: ts.CallExpression,\n    calleeName: \"request.security\" | \"request.lowerTf\",\n    sourceFile: ts.SourceFile,\n    sourcePath: string,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n    diagnostics: CompileDiagnostic[],\n    intervals: Set<string>,\n): void {\n    const opts = call.arguments[0];\n    if (opts === undefined || !ts.isObjectLiteralExpression(opts)) return;\n    const intervalProperty = opts.properties\n        .filter(ts.isPropertyAssignment)\n        .find((property) => ts.isIdentifier(property.name) && property.name.text === \"interval\");\n    if (intervalProperty === undefined) return;\n\n    const initializer = intervalProperty.initializer;\n    if (ts.isStringLiteral(initializer)) {\n        intervals.add(initializer.text);\n        return;\n    }\n\n    const enumOptions = getInputsEnumOptions(initializer, inputs);\n    if (enumOptions !== null) {\n        for (const option of enumOptions) intervals.add(option);\n        return;\n    }\n\n    diagnostics.push(\n        createDiagnostic({\n            severity: \"error\",\n            code:\n                calleeName === \"request.lowerTf\"\n                    ? \"request-lower-tf-interval-not-literal\"\n                    : \"request-security-interval-not-literal\",\n            message: `${calleeName}({ interval }) must be a string literal or input.enum value`,\n            file: sourcePath,\n            node: initializer,\n            sourceFile,\n        }),\n    );\n}\n\nfunction getInputsEnumOptions(\n    expr: ts.Expression,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n): ReadonlyArray<string> | null {\n    if (\n        !ts.isPropertyAccessExpression(expr) ||\n        !ts.isIdentifier(expr.expression) ||\n        expr.expression.text !== \"inputs\"\n    ) {\n        return null;\n    }\n    const descriptor = inputs[expr.name.text];\n    if (descriptor === undefined || descriptor.kind !== \"enum\") return null;\n    const options = descriptor.options;\n    if (!Array.isArray(options)) return null;\n    const strings: string[] = [];\n    for (const option of options) {\n        if (typeof option !== \"string\") return null;\n        strings.push(option);\n    }\n    return Object.freeze(strings);\n}\n"]}
+{"version":3,"file":"extractRequestedIntervals.js","sourceRoot":"","sources":["../../src/analysis/extractRequestedIntervals.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAG/D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAA0B,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAmBjE;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,sBAAsB,CAClC,UAAyB,EACzB,OAAuB,EACvB,MAAqD,EACrD,WAAgC,EAChC,aAAqB,UAAU,CAAC,QAAQ,EACxC,mBAAmB,GAAG,KAAK;IAE3B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,mBAAmB,GAAmC,EAAE,CAAC;IAE/D,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACpD,IAAI,UAAU,KAAK,kBAAkB,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;gBACxE,mBAAmB,CACf,IAAI,EACJ,UAAU,EACV,UAAU,EACV,UAAU,EACV,MAAM,EACN,WAAW,EACX,SAAS,CACZ,CAAC;YACN,CAAC;YACD,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;gBACpC,sBAAsB,CAClB,IAAI,EACJ,UAAU,EACV,UAAU,EACV,OAAO,EACP,WAAW,EACX,mBAAmB,EACnB,mBAAmB,CACtB,CAAC;YACN,CAAC;QACL,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACnC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,mBAAmB,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE,CAAC;KAClE,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACrC,UAAyB,EACzB,OAAuB,EACvB,MAAqD,EACrD,WAAgC,EAChC,aAAqB,UAAU,CAAC,QAAQ;IAExC,OAAO,sBAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAC3B,IAAuB,EACvB,UAAyB,EACzB,UAAkB,EAClB,OAAuB,EACvB,WAAgC,EAChC,QAAiB,EACjB,GAAmC;IAEnC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACnC,IACI,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,EACtE,CAAC;QACC,OAAO;IACX,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACX,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GACX,UAAU,KAAK,SAAS,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,GAAG,CAAC,IAAI,CACJ,MAAM,CAAC,MAAM,CAAC;QACV,MAAM,EAAE,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC;QACnD,QAAQ;QACR,SAAS;KACZ,CAAC,CACL,CAAC;AACN,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAAuB;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;SACnC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC7F,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;IACjD,OAAO,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACrE,CAAC;AAED,SAAS,mBAAmB,CACxB,IAAuB,EACvB,UAAkD,EAClD,UAAyB,EACzB,UAAkB,EAClB,MAAqD,EACrD,WAAgC,EAChC,SAAsB;IAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO;IACtE,MAAM,gBAAgB,GAAG,IAAI,CAAC,UAAU;SACnC,MAAM,CAAC,EAAE,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC7F,IAAI,gBAAgB,KAAK,SAAS;QAAE,OAAO;IAE3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,WAAW,CAAC;IACjD,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO;IACX,CAAC;IAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,WAAW;YAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;IACX,CAAC;IAED,WAAW,CAAC,IAAI,CACZ,gBAAgB,CAAC;QACb,QAAQ,EAAE,OAAO;QACjB,IAAI,EACA,UAAU,KAAK,iBAAiB;YAC5B,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,uCAAuC;QACjD,OAAO,EAAE,GAAG,UAAU,6DAA6D;QACnF,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,WAAW;QACjB,UAAU;KACb,CAAC,CACL,CAAC;AACN,CAAC;AAED,SAAS,oBAAoB,CACzB,IAAmB,EACnB,MAAqD;IAErD,IACI,CAAC,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QACpC,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,QAAQ,EACnC,CAAC;QACC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACxE,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nimport type { SecurityExpressionDescriptor } from \"@invinite-org/chartlang-core\";\nimport ts from \"typescript\";\n\nimport { type CompileDiagnostic, createDiagnostic } from \"../diagnostics.js\";\nimport { callsiteIdFor } from \"../transformers/callsiteIdInjection.js\";\nimport { resolveCalleeName } from \"../transformers/resolveCallee.js\";\nimport type { ExtractedDescriptor } from \"./extractInputs.js\";\nimport { validateSecurityExpr } from \"./validateSecurityExpr.js\";\n\n/**\n * Combined result of the `request.*` analysis pass: the sorted, deduped list\n * of requested intervals plus one {@link SecurityExpressionDescriptor} per\n * `request.security({ interval }, (bar) => …)` expression callsite (sorted by\n * `slotId`).\n *\n * @since 0.7\n * @stable\n * @example\n *     const r: RequestAnalysis = { intervals: [\"1W\"], securityExpressions: [] };\n *     void r;\n */\nexport type RequestAnalysis = Readonly<{\n    intervals: ReadonlyArray<string>;\n    securityExpressions: ReadonlyArray<SecurityExpressionDescriptor>;\n}>;\n\n/**\n * Walk a script's AST and collect every static `interval` argument to\n * `request.security({ interval: ... })` and `request.lowerTf(...)`, plus every\n * `request.security` *expression* callsite (a second arrow/function argument).\n * Dynamic intervals emit `request-security-interval-not-literal` (for\n * `request.security`) or `request-lower-tf-interval-not-literal` (for\n * `request.lowerTf`) and are excluded.\n *\n * Each expression callsite is recorded as a {@link SecurityExpressionDescriptor}\n * keyed by the same `slotId` the callsite-id transformer injects (via the\n * shared `callsiteIdFor` helper) so the runtime can match the manifest entry\n * to the inlined callback. When `validateExpressions` is `true`, each callback\n * is also run through {@link validateSecurityExpr}, pushing\n * `request-security-expr-captures-local` for any out-of-subset reference.\n *\n * @since 0.7\n * @stable\n * @example\n *     // const { intervals, securityExpressions } =\n *     //     extractRequestAnalysis(sf, checker, inputs, diagnostics, path, true);\n *     const fn: typeof extractRequestAnalysis = extractRequestAnalysis;\n *     void fn;\n */\nexport function extractRequestAnalysis(\n    sourceFile: ts.SourceFile,\n    checker: ts.TypeChecker,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n    diagnostics: CompileDiagnostic[],\n    sourcePath: string = sourceFile.fileName,\n    validateExpressions = false,\n): RequestAnalysis {\n    const intervals = new Set<string>();\n    const securityExpressions: SecurityExpressionDescriptor[] = [];\n\n    const visit = (node: ts.Node): void => {\n        if (ts.isCallExpression(node)) {\n            const calleeName = resolveCalleeName(node, checker);\n            if (calleeName === \"request.security\" || calleeName === \"request.lowerTf\") {\n                readRequestInterval(\n                    node,\n                    calleeName,\n                    sourceFile,\n                    sourcePath,\n                    inputs,\n                    diagnostics,\n                    intervals,\n                );\n            }\n            if (calleeName === \"request.security\") {\n                readSecurityExpression(\n                    node,\n                    sourceFile,\n                    sourcePath,\n                    checker,\n                    diagnostics,\n                    validateExpressions,\n                    securityExpressions,\n                );\n            }\n        }\n        ts.forEachChild(node, visit);\n    };\n\n    ts.forEachChild(sourceFile, visit);\n    securityExpressions.sort((a, b) => a.slotId.localeCompare(b.slotId));\n    return Object.freeze({\n        intervals: Object.freeze(Array.from(intervals).sort()),\n        securityExpressions: Object.freeze(securityExpressions.slice()),\n    });\n}\n\n/**\n * Walk a script's AST and collect every static `interval` argument to\n * `request.security({ interval: ... })` and `request.lowerTf(...)`. Dynamic\n * arguments emit `request-security-interval-not-literal` (for `request.security`)\n * or `request-lower-tf-interval-not-literal` (for `request.lowerTf`) and are\n * excluded. Thin delegate over {@link extractRequestAnalysis} kept for callers\n * that only need the interval list.\n *\n * @since 0.4\n * @example\n *     // const intervals = extractRequestedIntervals(sf, checker, inputs, diagnostics);\n *     // intervals === [\"1D\", \"5m\"];\n *     const fn: typeof extractRequestedIntervals = extractRequestedIntervals;\n *     void fn;\n */\nexport function extractRequestedIntervals(\n    sourceFile: ts.SourceFile,\n    checker: ts.TypeChecker,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n    diagnostics: CompileDiagnostic[],\n    sourcePath: string = sourceFile.fileName,\n): ReadonlyArray<string> {\n    return extractRequestAnalysis(sourceFile, checker, inputs, diagnostics, sourcePath).intervals;\n}\n\n/**\n * Detect and record a `request.security` expression callsite — a second\n * argument that is an arrow or function expression. Mints the descriptor's\n * `slotId` via `callsiteIdFor` (lockstep with the injector), reads the literal\n * `interval` and the callback's single parameter name, and — when\n * `validate` — runs the capture check. A callsite whose interval is not a\n * compile-time literal already emitted `request-security-interval-not-literal`\n * via `readRequestInterval`; it is skipped here (no descriptor).\n */\nfunction readSecurityExpression(\n    call: ts.CallExpression,\n    sourceFile: ts.SourceFile,\n    sourcePath: string,\n    checker: ts.TypeChecker,\n    diagnostics: CompileDiagnostic[],\n    validate: boolean,\n    out: SecurityExpressionDescriptor[],\n): void {\n    const callback = call.arguments[1];\n    if (\n        callback === undefined ||\n        !(ts.isArrowFunction(callback) || ts.isFunctionExpression(callback))\n    ) {\n        return;\n    }\n    if (validate) {\n        validateSecurityExpr(callback, checker, diagnostics, sourcePath);\n    }\n    const interval = readLiteralInterval(call);\n    if (interval === null) return;\n    const firstParam = callback.parameters[0];\n    const paramName =\n        firstParam !== undefined && ts.isIdentifier(firstParam.name) ? firstParam.name.text : \"\";\n    out.push(\n        Object.freeze({\n            slotId: callsiteIdFor(sourceFile, call, sourcePath),\n            interval,\n            paramName,\n        }),\n    );\n}\n\n/**\n * Read the literal `interval` string off a `request.security` call's opts\n * object, or `null` when it is absent or non-literal. Only string-literal\n * intervals key an expression unit; an `input.enum` interval expands to\n * multiple intervals for the requested-interval list but cannot anchor a\n * single expression clock, so it is treated as non-literal here.\n */\nfunction readLiteralInterval(call: ts.CallExpression): string | null {\n    const opts = call.arguments[0];\n    if (opts === undefined || !ts.isObjectLiteralExpression(opts)) return null;\n    const intervalProperty = opts.properties\n        .filter(ts.isPropertyAssignment)\n        .find((property) => ts.isIdentifier(property.name) && property.name.text === \"interval\");\n    if (intervalProperty === undefined) return null;\n    const initializer = intervalProperty.initializer;\n    return ts.isStringLiteral(initializer) ? initializer.text : null;\n}\n\nfunction readRequestInterval(\n    call: ts.CallExpression,\n    calleeName: \"request.security\" | \"request.lowerTf\",\n    sourceFile: ts.SourceFile,\n    sourcePath: string,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n    diagnostics: CompileDiagnostic[],\n    intervals: Set<string>,\n): void {\n    const opts = call.arguments[0];\n    if (opts === undefined || !ts.isObjectLiteralExpression(opts)) return;\n    const intervalProperty = opts.properties\n        .filter(ts.isPropertyAssignment)\n        .find((property) => ts.isIdentifier(property.name) && property.name.text === \"interval\");\n    if (intervalProperty === undefined) return;\n\n    const initializer = intervalProperty.initializer;\n    if (ts.isStringLiteral(initializer)) {\n        intervals.add(initializer.text);\n        return;\n    }\n\n    const enumOptions = getInputsEnumOptions(initializer, inputs);\n    if (enumOptions !== null) {\n        for (const option of enumOptions) intervals.add(option);\n        return;\n    }\n\n    diagnostics.push(\n        createDiagnostic({\n            severity: \"error\",\n            code:\n                calleeName === \"request.lowerTf\"\n                    ? \"request-lower-tf-interval-not-literal\"\n                    : \"request-security-interval-not-literal\",\n            message: `${calleeName}({ interval }) must be a string literal or input.enum value`,\n            file: sourcePath,\n            node: initializer,\n            sourceFile,\n        }),\n    );\n}\n\nfunction getInputsEnumOptions(\n    expr: ts.Expression,\n    inputs: Readonly<Record<string, ExtractedDescriptor>>,\n): ReadonlyArray<string> | null {\n    if (\n        !ts.isPropertyAccessExpression(expr) ||\n        !ts.isIdentifier(expr.expression) ||\n        expr.expression.text !== \"inputs\"\n    ) {\n        return null;\n    }\n    const descriptor = inputs[expr.name.text];\n    if (descriptor === undefined || descriptor.kind !== \"enum\") return null;\n    const options = descriptor.options;\n    if (!Array.isArray(options)) return null;\n    const strings: string[] = [];\n    for (const option of options) {\n        if (typeof option !== \"string\") return null;\n        strings.push(option);\n    }\n    return Object.freeze(strings);\n}\n"]}

package/dist/analysis/forbiddenConstructs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forbiddenConstructs.d.ts","sourceRoot":"","sources":["../../src/analysis/forbiddenConstructs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,KAAK,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAwB7E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAClC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,UAAU,EAAE,MAAM,GACnB,aAAa,CAAC,iBAAiB,CAAC,CAoLlC"}
+{"version":3,"file":"forbiddenConstructs.d.ts","sourceRoot":"","sources":["../../src/analysis/forbiddenConstructs.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAAE,KAAK,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AAkB7E;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CAClC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,UAAU,EAAE,MAAM,GACnB,aAAa,CAAC,iBAAiB,CAAC,CA8JlC"}

package/dist/analysis/forbiddenConstructs.js

@@ -2,6 +2,7 @@
 // See the LICENSE file in the repo root for full license text.
 import ts from "typescript";
 import { createDiagnostic } from "../diagnostics.js";
+import { parseBoundedForLoop } from "./loopBounds.js";
 const HOSTILE_GLOBAL_NAMES = new Set([
     "fetch",
     "setTimeout",
@@ -16,12 +17,6 @@ const HOSTILE_GLOBAL_NAMES = new Set([
     // this helper; user scripts must not name-collide with the slot.
     "__chartlang_depOutput",
 ]);
-const COMPARISON_OPS = new Set([
-    ts.SyntaxKind.LessThanToken,
-    ts.SyntaxKind.LessThanEqualsToken,
-    ts.SyntaxKind.GreaterThanToken,
-    ts.SyntaxKind.GreaterThanEqualsToken,
-]);
 /**
  * Walk the source file and emit a diagnostic for every forbidden construct:
  *
@@ -51,40 +46,6 @@ export function runForbiddenConstructs(sourceFile, sourcePath) {
             sourceFile,
         }));
     }
-    function checkForStatement(node) {
-        const init = node.initializer;
-        const condition = node.condition;
-        const incrementor = node.incrementor;
-        if (!init || !condition || !incrementor)
-            return false;
-        if (!ts.isVariableDeclarationList(init))
-            return false;
-        if (init.declarations.length !== 1)
-            return false;
-        const declaration = init.declarations[0];
-        if (!declaration || !ts.isIdentifier(declaration.name))
-            return false;
-        const initializer = declaration.initializer;
-        if (!initializer || !ts.isNumericLiteral(initializer))
-            return false;
-        if (!ts.isBinaryExpression(condition))
-            return false;
-        if (!COMPARISON_OPS.has(condition.operatorToken.kind))
-            return false;
-        if (!ts.isNumericLiteral(condition.right))
-            return false;
-        if (!ts.isIdentifier(condition.left))
-            return false;
-        if (condition.left.text !== declaration.name.text)
-            return false;
-        if (!ts.isPostfixUnaryExpression(incrementor))
-            return false;
-        if (!ts.isIdentifier(incrementor.operand))
-            return false;
-        if (incrementor.operand.text !== declaration.name.text)
-            return false;
-        return true;
-    }
     function isInsideAncestor(node, predicate) {
         let current = node.parent;
         while (current) {
@@ -140,7 +101,7 @@ export function runForbiddenConstructs(sourceFile, sourcePath) {
             emit(node, "unbounded-loop", "`for…in` loops are not allowed.");
         }
         else if (ts.isForStatement(node)) {
-            if (!checkForStatement(node)) {
+            if (parseBoundedForLoop(node) === null) {
                 emit(node, "unbounded-loop", "`for` loops must use literal numeric bounds: for (let i = <num>; i </<= <num>; i++).");
             }
         }

package/dist/analysis/forbiddenConstructs.js.map

@@ -1 +1 @@
-{"version":3,"file":"forbiddenConstructs.js","sourceRoot":"","sources":["../../src/analysis/forbiddenConstructs.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAA0B,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE7E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,SAAS;IACT,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,SAAS;IACT,oEAAoE;IACpE,iEAAiE;IACjE,uBAAuB;CAC1B,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAgB;IAC1C,EAAE,CAAC,UAAU,CAAC,aAAa;IAC3B,EAAE,CAAC,UAAU,CAAC,mBAAmB;IACjC,EAAE,CAAC,UAAU,CAAC,gBAAgB;IAC9B,EAAE,CAAC,UAAU,CAAC,sBAAsB;CACvC,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAClC,UAAyB,EACzB,UAAkB;IAElB,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,SAAS,IAAI,CACT,IAAa,EACb,IAAmE,EACnE,OAAe;QAEf,WAAW,CAAC,IAAI,CACZ,gBAAgB,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,IAAI;YACJ,UAAU;SACb,CAAC,CACL,CAAC;IACN,CAAC;IAED,SAAS,iBAAiB,CAAC,IAAqB;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACtD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,WAAW,GAAG,WAAW,CAAC,WAAW,CAAC;QAC5C,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QACpD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC;QACrE,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,SAAS,gBAAgB,CAAC,IAAa,EAAE,SAAuC;QAC5E,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;QAC/C,OAAO,OAAO,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,SAAS,iBAAiB,CAAC,MAAe,EAAE,IAAmB;QAC3D,MAAM,KAAK,GAAG,MAAqC,CAAC;QACpD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,CACH,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAChC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAC/B,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC7B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC5B,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAChC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YACtB,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACjC,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACjC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC5B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACjC,CAAC;IACN,CAAC;IAED,SAAS,qBAAqB,CAAC,IAAa;QACxC,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;QAC/C,OAAO,OAAO,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC;YACD,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;gBACxC,IACI,WAAW;oBACX,CAAC,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EAC3E,CAAC;oBACC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7B,CAAC;YACL,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,4CAA4C,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CACA,IAAI,EACJ,gBAAgB,EAChB,sFAAsF,CACzF,CAAC;YACN,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;gBAC3D,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACjD,IACI,YAAY,KAAK,IAAI;gBACrB,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC3B,UAAU,CAAC,IAAI,KAAK,YAAY,EAClC,CAAC;gBACC,IAAI,CACA,IAAI,EACJ,uBAAuB,EACvB,4BAA4B,YAAY,oBAAoB,CAC/D,CAAC;YACN,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;YACxE,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;iBAAM,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,IACI,MAAM;gBACN,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;oBAClC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;oBAC/B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAC9B,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;oBAC5B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EACnC,CAAC;gBACC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,MAAM,mBAAmB,GAAG,gBAAgB,CACxC,IAAI,EACJ,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAC5E,CAAC;YACF,IAAI,mBAAmB,EAAE,CAAC;gBACtB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;QACrE,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nimport ts from \"typescript\";\n\nimport { type CompileDiagnostic, createDiagnostic } from \"../diagnostics.js\";\n\nconst HOSTILE_GLOBAL_NAMES = new Set([\n    \"fetch\",\n    \"setTimeout\",\n    \"setInterval\",\n    \"queueMicrotask\",\n    \"Promise\",\n    \"requestAnimationFrame\",\n    \"Date\",\n    \"eval\",\n    \"require\",\n    // Phase 7 — the indicator-composition rewriter synthesises calls to\n    // this helper; user scripts must not name-collide with the slot.\n    \"__chartlang_depOutput\",\n]);\n\nconst COMPARISON_OPS = new Set<ts.SyntaxKind>([\n    ts.SyntaxKind.LessThanToken,\n    ts.SyntaxKind.LessThanEqualsToken,\n    ts.SyntaxKind.GreaterThanToken,\n    ts.SyntaxKind.GreaterThanEqualsToken,\n]);\n\n/**\n * Walk the source file and emit a diagnostic for every forbidden construct:\n *\n * - `while` / `do-while` / `for-of` / `for-in` / unbounded `for` →\n *   `unbounded-loop`.\n * - Self-recursive function declaration → `recursion-not-allowed`.\n * - References to hostile globals (`Math.random`, `Date.*`, `fetch`,\n *   `setTimeout`, `setInterval`, `queueMicrotask`, `Promise`,\n *   `requestAnimationFrame`), plus `require(...)`, dynamic `import(...)`,\n *   `eval(...)`, `new Function(...)` → `hostile-global`.\n *\n * @since 0.1\n * @example\n *     // const diagnostics = runForbiddenConstructs(sourceFile, \"demo.chart.ts\");\n *     const fn: typeof runForbiddenConstructs = runForbiddenConstructs;\n *     void fn;\n */\nexport function runForbiddenConstructs(\n    sourceFile: ts.SourceFile,\n    sourcePath: string,\n): ReadonlyArray<CompileDiagnostic> {\n    const diagnostics: CompileDiagnostic[] = [];\n\n    function emit(\n        node: ts.Node,\n        code: \"unbounded-loop\" | \"recursion-not-allowed\" | \"hostile-global\",\n        message: string,\n    ): void {\n        diagnostics.push(\n            createDiagnostic({\n                severity: \"error\",\n                code,\n                message,\n                file: sourcePath,\n                node,\n                sourceFile,\n            }),\n        );\n    }\n\n    function checkForStatement(node: ts.ForStatement): boolean {\n        const init = node.initializer;\n        const condition = node.condition;\n        const incrementor = node.incrementor;\n        if (!init || !condition || !incrementor) return false;\n        if (!ts.isVariableDeclarationList(init)) return false;\n        if (init.declarations.length !== 1) return false;\n        const declaration = init.declarations[0];\n        if (!declaration || !ts.isIdentifier(declaration.name)) return false;\n        const initializer = declaration.initializer;\n        if (!initializer || !ts.isNumericLiteral(initializer)) return false;\n        if (!ts.isBinaryExpression(condition)) return false;\n        if (!COMPARISON_OPS.has(condition.operatorToken.kind)) return false;\n        if (!ts.isNumericLiteral(condition.right)) return false;\n        if (!ts.isIdentifier(condition.left)) return false;\n        if (condition.left.text !== declaration.name.text) return false;\n        if (!ts.isPostfixUnaryExpression(incrementor)) return false;\n        if (!ts.isIdentifier(incrementor.operand)) return false;\n        if (incrementor.operand.text !== declaration.name.text) return false;\n        return true;\n    }\n\n    function isInsideAncestor(node: ts.Node, predicate: (parent: ts.Node) => boolean): boolean {\n        let current: ts.Node | undefined = node.parent;\n        while (current) {\n            if (predicate(current)) return true;\n            current = current.parent;\n        }\n        return false;\n    }\n\n    function isDeclarationName(parent: ts.Node, node: ts.Identifier): boolean {\n        const named = parent as { readonly name?: ts.Node };\n        if (named.name !== node) return false;\n        return (\n            ts.isFunctionDeclaration(parent) ||\n            ts.isFunctionExpression(parent) ||\n            ts.isClassDeclaration(parent) ||\n            ts.isClassExpression(parent) ||\n            ts.isVariableDeclaration(parent) ||\n            ts.isParameter(parent) ||\n            ts.isInterfaceDeclaration(parent) ||\n            ts.isTypeAliasDeclaration(parent) ||\n            ts.isEnumDeclaration(parent) ||\n            ts.isModuleDeclaration(parent)\n        );\n    }\n\n    function enclosingFunctionName(node: ts.Node): string | null {\n        let current: ts.Node | undefined = node.parent;\n        while (current) {\n            if (ts.isFunctionDeclaration(current) && current.name) {\n                return current.name.text;\n            }\n            if (ts.isVariableDeclaration(current) && ts.isIdentifier(current.name)) {\n                const initializer = current.initializer;\n                if (\n                    initializer &&\n                    (ts.isFunctionExpression(initializer) || ts.isArrowFunction(initializer))\n                ) {\n                    return current.name.text;\n                }\n            }\n            current = current.parent;\n        }\n        return null;\n    }\n\n    const visit = (node: ts.Node): void => {\n        if (ts.isWhileStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`while` loops are not allowed.\");\n        } else if (ts.isDoStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`do…while` loops are not allowed.\");\n        } else if (ts.isForOfStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`for…of` loops are not allowed in Phase 1.\");\n        } else if (ts.isForInStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`for…in` loops are not allowed.\");\n        } else if (ts.isForStatement(node)) {\n            if (!checkForStatement(node)) {\n                emit(\n                    node,\n                    \"unbounded-loop\",\n                    \"`for` loops must use literal numeric bounds: for (let i = <num>; i </<= <num>; i++).\",\n                );\n            }\n        } else if (ts.isCallExpression(node)) {\n            const expression = node.expression;\n            if (ts.isIdentifier(expression)) {\n                if (expression.text === \"eval\") {\n                    emit(node, \"hostile-global\", \"`eval` is not allowed.\");\n                } else if (expression.text === \"require\") {\n                    emit(node, \"hostile-global\", \"`require` is not allowed.\");\n                }\n            } else if (expression.kind === ts.SyntaxKind.ImportKeyword) {\n                emit(node, \"hostile-global\", \"Dynamic `import()` is not allowed.\");\n            }\n            const functionName = enclosingFunctionName(node);\n            if (\n                functionName !== null &&\n                ts.isIdentifier(expression) &&\n                expression.text === functionName\n            ) {\n                emit(\n                    node,\n                    \"recursion-not-allowed\",\n                    `Self-recursive call to \\`${functionName}\\` is not allowed.`,\n                );\n            }\n        } else if (ts.isNewExpression(node)) {\n            const expression = node.expression;\n            if (ts.isIdentifier(expression) && expression.text === \"Function\") {\n                emit(node, \"hostile-global\", \"`new Function(...)` is not allowed.\");\n            }\n        } else if (ts.isPropertyAccessExpression(node)) {\n            const objectName = node.expression;\n            if (ts.isIdentifier(objectName) && objectName.text === \"Math\") {\n                if (node.name.text === \"random\") {\n                    emit(node, \"hostile-global\", \"`Math.random` is not allowed.\");\n                }\n            } else if (ts.isIdentifier(objectName) && objectName.text === \"Date\") {\n                emit(node, \"hostile-global\", \"`Date.*` is not allowed.\");\n            }\n        } else if (ts.isIdentifier(node)) {\n            if (!HOSTILE_GLOBAL_NAMES.has(node.text)) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            const parent = node.parent;\n            if (parent && isDeclarationName(parent, node)) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            if (\n                parent &&\n                (ts.isPropertyAccessExpression(parent) ||\n                    ts.isPropertyAssignment(parent) ||\n                    ts.isPropertySignature(parent) ||\n                    ts.isBindingElement(parent) ||\n                    ts.isImportSpecifier(parent) ||\n                    ts.isExportSpecifier(parent))\n            ) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            const isInsideTypeContext = isInsideAncestor(\n                node,\n                (ancestor) => ts.isTypeNode(ancestor) || ts.isTypeReferenceNode(ancestor),\n            );\n            if (isInsideTypeContext) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            emit(node, \"hostile-global\", `\\`${node.text}\\` is not allowed.`);\n        }\n        ts.forEachChild(node, visit);\n    };\n\n    ts.forEachChild(sourceFile, visit);\n\n    return Object.freeze(diagnostics.slice());\n}\n"]}
+{"version":3,"file":"forbiddenConstructs.js","sourceRoot":"","sources":["../../src/analysis/forbiddenConstructs.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,OAAO,EAA0B,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,OAAO;IACP,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,SAAS;IACT,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,SAAS;IACT,oEAAoE;IACpE,iEAAiE;IACjE,uBAAuB;CAC1B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CAClC,UAAyB,EACzB,UAAkB;IAElB,MAAM,WAAW,GAAwB,EAAE,CAAC;IAE5C,SAAS,IAAI,CACT,IAAa,EACb,IAAmE,EACnE,OAAe;QAEf,WAAW,CAAC,IAAI,CACZ,gBAAgB,CAAC;YACb,QAAQ,EAAE,OAAO;YACjB,IAAI;YACJ,OAAO;YACP,IAAI,EAAE,UAAU;YAChB,IAAI;YACJ,UAAU;SACb,CAAC,CACL,CAAC;IACN,CAAC;IAED,SAAS,gBAAgB,CAAC,IAAa,EAAE,SAAuC;QAC5E,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;QAC/C,OAAO,OAAO,EAAE,CAAC;YACb,IAAI,SAAS,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,SAAS,iBAAiB,CAAC,MAAe,EAAE,IAAmB;QAC3D,MAAM,KAAK,GAAG,MAAqC,CAAC;QACpD,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,CACH,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAChC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;YAC/B,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC7B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC5B,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC;YAChC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;YACtB,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACjC,EAAE,CAAC,sBAAsB,CAAC,MAAM,CAAC;YACjC,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;YAC5B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CACjC,CAAC;IACN,CAAC;IAED,SAAS,qBAAqB,CAAC,IAAa;QACxC,IAAI,OAAO,GAAwB,IAAI,CAAC,MAAM,CAAC;QAC/C,OAAO,OAAO,EAAE,CAAC;YACb,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACpD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC7B,CAAC;YACD,IAAI,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;gBACxC,IACI,WAAW;oBACX,CAAC,EAAE,CAAC,oBAAoB,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,EAC3E,CAAC;oBACC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAC7B,CAAC;YACL,CAAC;YACD,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,mCAAmC,CAAC,CAAC;QACtE,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,4CAA4C,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,iCAAiC,CAAC,CAAC;QACpE,CAAC;aAAM,IAAI,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACrC,IAAI,CACA,IAAI,EACJ,gBAAgB,EAChB,sFAAsF,CACzF,CAAC;YACN,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;oBAC7B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC;gBAC3D,CAAC;qBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBACvC,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;gBAC9D,CAAC;YACL,CAAC;iBAAM,IAAI,UAAU,CAAC,IAAI,KAAK,EAAE,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;gBACzD,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACjD,IACI,YAAY,KAAK,IAAI;gBACrB,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC3B,UAAU,CAAC,IAAI,KAAK,YAAY,EAClC,CAAC;gBACC,IAAI,CACA,IAAI,EACJ,uBAAuB,EACvB,4BAA4B,YAAY,oBAAoB,CAC/D,CAAC;YACN,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,qCAAqC,CAAC,CAAC;YACxE,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YACnC,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC5D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC9B,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,+BAA+B,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;iBAAM,IAAI,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnE,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,0BAA0B,CAAC,CAAC;YAC7D,CAAC;QACL,CAAC;aAAM,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC3B,IAAI,MAAM,IAAI,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC5C,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,IACI,MAAM;gBACN,CAAC,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC;oBAClC,EAAE,CAAC,oBAAoB,CAAC,MAAM,CAAC;oBAC/B,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;oBAC9B,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC;oBAC5B,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,EACnC,CAAC;gBACC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,MAAM,mBAAmB,GAAG,gBAAgB,CACxC,IAAI,EACJ,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAC5E,CAAC;YACF,IAAI,mBAAmB,EAAE,CAAC;gBACtB,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC7B,OAAO;YACX,CAAC;YACD,IAAI,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,IAAI,CAAC,IAAI,oBAAoB,CAAC,CAAC;QACrE,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;IAEF,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAEnC,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nimport ts from \"typescript\";\n\nimport { type CompileDiagnostic, createDiagnostic } from \"../diagnostics.js\";\nimport { parseBoundedForLoop } from \"./loopBounds.js\";\n\nconst HOSTILE_GLOBAL_NAMES = new Set([\n    \"fetch\",\n    \"setTimeout\",\n    \"setInterval\",\n    \"queueMicrotask\",\n    \"Promise\",\n    \"requestAnimationFrame\",\n    \"Date\",\n    \"eval\",\n    \"require\",\n    // Phase 7 — the indicator-composition rewriter synthesises calls to\n    // this helper; user scripts must not name-collide with the slot.\n    \"__chartlang_depOutput\",\n]);\n\n/**\n * Walk the source file and emit a diagnostic for every forbidden construct:\n *\n * - `while` / `do-while` / `for-of` / `for-in` / unbounded `for` →\n *   `unbounded-loop`.\n * - Self-recursive function declaration → `recursion-not-allowed`.\n * - References to hostile globals (`Math.random`, `Date.*`, `fetch`,\n *   `setTimeout`, `setInterval`, `queueMicrotask`, `Promise`,\n *   `requestAnimationFrame`), plus `require(...)`, dynamic `import(...)`,\n *   `eval(...)`, `new Function(...)` → `hostile-global`.\n *\n * @since 0.1\n * @example\n *     // const diagnostics = runForbiddenConstructs(sourceFile, \"demo.chart.ts\");\n *     const fn: typeof runForbiddenConstructs = runForbiddenConstructs;\n *     void fn;\n */\nexport function runForbiddenConstructs(\n    sourceFile: ts.SourceFile,\n    sourcePath: string,\n): ReadonlyArray<CompileDiagnostic> {\n    const diagnostics: CompileDiagnostic[] = [];\n\n    function emit(\n        node: ts.Node,\n        code: \"unbounded-loop\" | \"recursion-not-allowed\" | \"hostile-global\",\n        message: string,\n    ): void {\n        diagnostics.push(\n            createDiagnostic({\n                severity: \"error\",\n                code,\n                message,\n                file: sourcePath,\n                node,\n                sourceFile,\n            }),\n        );\n    }\n\n    function isInsideAncestor(node: ts.Node, predicate: (parent: ts.Node) => boolean): boolean {\n        let current: ts.Node | undefined = node.parent;\n        while (current) {\n            if (predicate(current)) return true;\n            current = current.parent;\n        }\n        return false;\n    }\n\n    function isDeclarationName(parent: ts.Node, node: ts.Identifier): boolean {\n        const named = parent as { readonly name?: ts.Node };\n        if (named.name !== node) return false;\n        return (\n            ts.isFunctionDeclaration(parent) ||\n            ts.isFunctionExpression(parent) ||\n            ts.isClassDeclaration(parent) ||\n            ts.isClassExpression(parent) ||\n            ts.isVariableDeclaration(parent) ||\n            ts.isParameter(parent) ||\n            ts.isInterfaceDeclaration(parent) ||\n            ts.isTypeAliasDeclaration(parent) ||\n            ts.isEnumDeclaration(parent) ||\n            ts.isModuleDeclaration(parent)\n        );\n    }\n\n    function enclosingFunctionName(node: ts.Node): string | null {\n        let current: ts.Node | undefined = node.parent;\n        while (current) {\n            if (ts.isFunctionDeclaration(current) && current.name) {\n                return current.name.text;\n            }\n            if (ts.isVariableDeclaration(current) && ts.isIdentifier(current.name)) {\n                const initializer = current.initializer;\n                if (\n                    initializer &&\n                    (ts.isFunctionExpression(initializer) || ts.isArrowFunction(initializer))\n                ) {\n                    return current.name.text;\n                }\n            }\n            current = current.parent;\n        }\n        return null;\n    }\n\n    const visit = (node: ts.Node): void => {\n        if (ts.isWhileStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`while` loops are not allowed.\");\n        } else if (ts.isDoStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`do…while` loops are not allowed.\");\n        } else if (ts.isForOfStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`for…of` loops are not allowed in Phase 1.\");\n        } else if (ts.isForInStatement(node)) {\n            emit(node, \"unbounded-loop\", \"`for…in` loops are not allowed.\");\n        } else if (ts.isForStatement(node)) {\n            if (parseBoundedForLoop(node) === null) {\n                emit(\n                    node,\n                    \"unbounded-loop\",\n                    \"`for` loops must use literal numeric bounds: for (let i = <num>; i </<= <num>; i++).\",\n                );\n            }\n        } else if (ts.isCallExpression(node)) {\n            const expression = node.expression;\n            if (ts.isIdentifier(expression)) {\n                if (expression.text === \"eval\") {\n                    emit(node, \"hostile-global\", \"`eval` is not allowed.\");\n                } else if (expression.text === \"require\") {\n                    emit(node, \"hostile-global\", \"`require` is not allowed.\");\n                }\n            } else if (expression.kind === ts.SyntaxKind.ImportKeyword) {\n                emit(node, \"hostile-global\", \"Dynamic `import()` is not allowed.\");\n            }\n            const functionName = enclosingFunctionName(node);\n            if (\n                functionName !== null &&\n                ts.isIdentifier(expression) &&\n                expression.text === functionName\n            ) {\n                emit(\n                    node,\n                    \"recursion-not-allowed\",\n                    `Self-recursive call to \\`${functionName}\\` is not allowed.`,\n                );\n            }\n        } else if (ts.isNewExpression(node)) {\n            const expression = node.expression;\n            if (ts.isIdentifier(expression) && expression.text === \"Function\") {\n                emit(node, \"hostile-global\", \"`new Function(...)` is not allowed.\");\n            }\n        } else if (ts.isPropertyAccessExpression(node)) {\n            const objectName = node.expression;\n            if (ts.isIdentifier(objectName) && objectName.text === \"Math\") {\n                if (node.name.text === \"random\") {\n                    emit(node, \"hostile-global\", \"`Math.random` is not allowed.\");\n                }\n            } else if (ts.isIdentifier(objectName) && objectName.text === \"Date\") {\n                emit(node, \"hostile-global\", \"`Date.*` is not allowed.\");\n            }\n        } else if (ts.isIdentifier(node)) {\n            if (!HOSTILE_GLOBAL_NAMES.has(node.text)) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            const parent = node.parent;\n            if (parent && isDeclarationName(parent, node)) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            if (\n                parent &&\n                (ts.isPropertyAccessExpression(parent) ||\n                    ts.isPropertyAssignment(parent) ||\n                    ts.isPropertySignature(parent) ||\n                    ts.isBindingElement(parent) ||\n                    ts.isImportSpecifier(parent) ||\n                    ts.isExportSpecifier(parent))\n            ) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            const isInsideTypeContext = isInsideAncestor(\n                node,\n                (ancestor) => ts.isTypeNode(ancestor) || ts.isTypeReferenceNode(ancestor),\n            );\n            if (isInsideTypeContext) {\n                ts.forEachChild(node, visit);\n                return;\n            }\n            emit(node, \"hostile-global\", `\\`${node.text}\\` is not allowed.`);\n        }\n        ts.forEachChild(node, visit);\n    };\n\n    ts.forEachChild(sourceFile, visit);\n\n    return Object.freeze(diagnostics.slice());\n}\n"]}

package/dist/analysis/index.d.ts

@@ -7,7 +7,9 @@ export { extractMaxLookback } from "./extractMaxLookback.js";
 export type { ExtractMaxLookbackResult } from "./extractMaxLookback.js";
 export { extractInputs } from "./extractInputs.js";
 export type { ExtractedDescriptor, ExtractInputsResult } from "./extractInputs.js";
-export { extractRequestedIntervals } from "./extractRequestedIntervals.js";
+export { extractRequestAnalysis, extractRequestedIntervals } from "./extractRequestedIntervals.js";
+export type { RequestAnalysis } from "./extractRequestedIntervals.js";
+export { validateSecurityExpr } from "./validateSecurityExpr.js";
 export { validateLowerTfIntervals } from "./validateLowerTfIntervals.js";
 export { extractRequiresIntervals } from "./extractRequiresIntervals.js";
 export { extractAlertConditions } from "./extractAlertConditions.js";

package/dist/analysis/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analysis/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACR,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,GAClB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/analysis/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AACnG,YAAY,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,YAAY,EACR,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,GAClB,MAAM,6BAA6B,CAAC"}

package/dist/analysis/index.js

@@ -6,7 +6,8 @@ export { runStatefulCallInLoop } from "./statefulCallInLoop.js";
 export { extractCapabilities } from "./extractCapabilities.js";
 export { extractMaxLookback } from "./extractMaxLookback.js";
 export { extractInputs } from "./extractInputs.js";
-export { extractRequestedIntervals } from "./extractRequestedIntervals.js";
+export { extractRequestAnalysis, extractRequestedIntervals } from "./extractRequestedIntervals.js";
+export { validateSecurityExpr } from "./validateSecurityExpr.js";
 export { validateLowerTfIntervals } from "./validateLowerTfIntervals.js";
 export { extractRequiresIntervals } from "./extractRequiresIntervals.js";
 export { extractAlertConditions } from "./extractAlertConditions.js";

package/dist/analysis/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analysis/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nexport { runStructuralChecks } from \"./structuralChecks.js\";\nexport type { StructuralBindingInfo, StructuralCheckResult } from \"./structuralChecks.js\";\nexport { runForbiddenConstructs } from \"./forbiddenConstructs.js\";\nexport { runStatefulCallInLoop } from \"./statefulCallInLoop.js\";\nexport { extractCapabilities } from \"./extractCapabilities.js\";\nexport { extractMaxLookback } from \"./extractMaxLookback.js\";\nexport type { ExtractMaxLookbackResult } from \"./extractMaxLookback.js\";\nexport { extractInputs } from \"./extractInputs.js\";\nexport type { ExtractedDescriptor, ExtractInputsResult } from \"./extractInputs.js\";\nexport { extractRequestedIntervals } from \"./extractRequestedIntervals.js\";\nexport { validateLowerTfIntervals } from \"./validateLowerTfIntervals.js\";\nexport { extractRequiresIntervals } from \"./extractRequiresIntervals.js\";\nexport { extractAlertConditions } from \"./extractAlertConditions.js\";\nexport type { ExtractAlertConditionsResult } from \"./extractAlertConditions.js\";\nexport { extractDependencyGraph } from \"./extractDependencyGraph.js\";\nexport type {\n    DepConsumesEntry,\n    DepGraph,\n    DrawnScript,\n    PrivateDep,\n    ProducerRef,\n    ProducerSnapshot,\n    ResolveProducer,\n} from \"./extractDependencyGraph.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/analysis/index.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAEnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nexport { runStructuralChecks } from \"./structuralChecks.js\";\nexport type { StructuralBindingInfo, StructuralCheckResult } from \"./structuralChecks.js\";\nexport { runForbiddenConstructs } from \"./forbiddenConstructs.js\";\nexport { runStatefulCallInLoop } from \"./statefulCallInLoop.js\";\nexport { extractCapabilities } from \"./extractCapabilities.js\";\nexport { extractMaxLookback } from \"./extractMaxLookback.js\";\nexport type { ExtractMaxLookbackResult } from \"./extractMaxLookback.js\";\nexport { extractInputs } from \"./extractInputs.js\";\nexport type { ExtractedDescriptor, ExtractInputsResult } from \"./extractInputs.js\";\nexport { extractRequestAnalysis, extractRequestedIntervals } from \"./extractRequestedIntervals.js\";\nexport type { RequestAnalysis } from \"./extractRequestedIntervals.js\";\nexport { validateSecurityExpr } from \"./validateSecurityExpr.js\";\nexport { validateLowerTfIntervals } from \"./validateLowerTfIntervals.js\";\nexport { extractRequiresIntervals } from \"./extractRequiresIntervals.js\";\nexport { extractAlertConditions } from \"./extractAlertConditions.js\";\nexport type { ExtractAlertConditionsResult } from \"./extractAlertConditions.js\";\nexport { extractDependencyGraph } from \"./extractDependencyGraph.js\";\nexport type {\n    DepConsumesEntry,\n    DepGraph,\n    DrawnScript,\n    PrivateDep,\n    ProducerRef,\n    ProducerSnapshot,\n    ResolveProducer,\n} from \"./extractDependencyGraph.js\";\n"]}

package/dist/analysis/loopBounds.d.ts

@@ -0,0 +1,91 @@
+import ts from "typescript";
+/**
+ * The comparison operators a legal chartlang `for` condition may use.
+ * Shared by `parseBoundedForLoop` (which captures the operator so a sizer
+ * can derive the loop's max index) and `forbiddenConstructs` (which rejects
+ * any other condition shape) so the two passes recognise the same set.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     COMPARISON_OPS.has(ts.SyntaxKind.LessThanToken); // → true
+ */
+export declare const COMPARISON_OPS: ReadonlySet<ts.SyntaxKind>;
+/**
+ * The parsed shape of a legal chartlang `for` loop.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     const loop: BoundedForLoop = {
+ *         varName: "i",
+ *         start: 0,
+ *         op: ts.SyntaxKind.LessThanToken,
+ *         limit: 5,
+ *     };
+ *     void loop;
+ */
+export type BoundedForLoop = Readonly<{
+    /** The induction variable name (the `i` in `for (let i = …)`). */
+    varName: string;
+    /** The literal initial value (`for (let i = <start>; …)`). */
+    start: number;
+    /** The comparison operator token used in the condition. */
+    op: ts.SyntaxKind;
+    /** The literal right-hand bound (`… i <op> <limit>; …`). */
+    limit: number;
+}>;
+/**
+ * Parse a `ts.ForStatement` into its `BoundedForLoop` shape, or `null`
+ * when it is not the one legal chartlang loop form
+ * (`for (let i = <numLit>; i <comparison> <numLit>; i++)` — single
+ * `let` init, id-on-left/literal-on-right condition, postfix `i++`).
+ * The single source of truth for "what is a bounded loop"; both
+ * `forbiddenConstructs` (reject everything else) and
+ * `resolveIndexUpperBound` (size the index range) call it so the two
+ * passes can never disagree.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // for (let i = 0; i < 5; i++) → { varName: "i", start: 0,
+ *     //                                  op: LessThanToken, limit: 5 }
+ *     const fn: typeof parseBoundedForLoop = parseBoundedForLoop;
+ *     void fn;
+ */
+export declare function parseBoundedForLoop(node: ts.ForStatement): BoundedForLoop | null;
+/**
+ * The induction variable's **declaration** identifier of the single legal
+ * chartlang loop *initializer* shape, or `null` otherwise. A sizer calls
+ * this directly when it needs the declaration node (not just the `varName`
+ * text) to ask the type checker whether an index use resolves to this
+ * loop's own binding rather than a nested shadow of the same name. Shares
+ * `parseBoundedForLoop`'s initializer acceptance via `parseLoopInit`.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // for (let i = 0; i < 5; i++) → the `i` declaration identifier
+ *     const fn: typeof boundedLoopVarId = boundedLoopVarId;
+ *     void fn;
+ */
+export declare function boundedLoopVarId(node: ts.ForStatement): ts.Identifier | null;
+/**
+ * Unwrap any number of nested parentheses around an expression. The Pine
+ * converter emits a historical bar offset as the parenthesised form
+ * `bar.point(-(N), …)` (see the converter's `anchorToWorldPoint`), so the
+ * lookback recogniser must peel the parens before matching the literal;
+ * the index-bound resolver does the same before matching a numeric leaf.
+ * Housed here — a leaf module with no analysis-package imports — so both
+ * `extractMaxLookback` and `resolveIndexBound` can share it without a
+ * circular import.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // unwrapParens of `((7))` → the `7` numeric-literal node
+ *     const fn: typeof unwrapParens = unwrapParens;
+ *     void fn;
+ */
+export declare function unwrapParens(node: ts.Expression): ts.Expression;
+//# sourceMappingURL=loopBounds.d.ts.map

package/dist/analysis/loopBounds.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopBounds.d.ts","sourceRoot":"","sources":["../../src/analysis/loopBounds.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,EAAE,CAAC,UAAU,CAKpD,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC;IAClC,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC;IAClB,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,GAAG,cAAc,GAAG,IAAI,CAoBhF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,GAAG,EAAE,CAAC,UAAU,GAAG,IAAI,CAE5E;AAsBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,GAAG,EAAE,CAAC,UAAU,CAI/D"}

package/dist/analysis/loopBounds.js

@@ -0,0 +1,132 @@
+// Copyright (c) 2026 Invinite. Licensed under the MIT License.
+// See the LICENSE file in the repo root for full license text.
+import ts from "typescript";
+/**
+ * The comparison operators a legal chartlang `for` condition may use.
+ * Shared by `parseBoundedForLoop` (which captures the operator so a sizer
+ * can derive the loop's max index) and `forbiddenConstructs` (which rejects
+ * any other condition shape) so the two passes recognise the same set.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     COMPARISON_OPS.has(ts.SyntaxKind.LessThanToken); // → true
+ */
+export const COMPARISON_OPS = new Set([
+    ts.SyntaxKind.LessThanToken,
+    ts.SyntaxKind.LessThanEqualsToken,
+    ts.SyntaxKind.GreaterThanToken,
+    ts.SyntaxKind.GreaterThanEqualsToken,
+]);
+/**
+ * Parse a `ts.ForStatement` into its `BoundedForLoop` shape, or `null`
+ * when it is not the one legal chartlang loop form
+ * (`for (let i = <numLit>; i <comparison> <numLit>; i++)` — single
+ * `let` init, id-on-left/literal-on-right condition, postfix `i++`).
+ * The single source of truth for "what is a bounded loop"; both
+ * `forbiddenConstructs` (reject everything else) and
+ * `resolveIndexUpperBound` (size the index range) call it so the two
+ * passes can never disagree.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // for (let i = 0; i < 5; i++) → { varName: "i", start: 0,
+ *     //                                  op: LessThanToken, limit: 5 }
+ *     const fn: typeof parseBoundedForLoop = parseBoundedForLoop;
+ *     void fn;
+ */
+export function parseBoundedForLoop(node) {
+    const init = parseLoopInit(node);
+    if (init === null)
+        return null;
+    const condition = node.condition;
+    const incrementor = node.incrementor;
+    if (!condition || !incrementor)
+        return null;
+    if (!ts.isBinaryExpression(condition))
+        return null;
+    if (!COMPARISON_OPS.has(condition.operatorToken.kind))
+        return null;
+    if (!ts.isNumericLiteral(condition.right))
+        return null;
+    if (!ts.isIdentifier(condition.left))
+        return null;
+    if (condition.left.text !== init.varId.text)
+        return null;
+    if (!ts.isPostfixUnaryExpression(incrementor))
+        return null;
+    if (!ts.isIdentifier(incrementor.operand))
+        return null;
+    if (incrementor.operand.text !== init.varId.text)
+        return null;
+    return {
+        varName: init.varId.text,
+        start: Number(init.start.text),
+        op: condition.operatorToken.kind,
+        limit: Number(condition.right.text),
+    };
+}
+/**
+ * The induction variable's **declaration** identifier of the single legal
+ * chartlang loop *initializer* shape, or `null` otherwise. A sizer calls
+ * this directly when it needs the declaration node (not just the `varName`
+ * text) to ask the type checker whether an index use resolves to this
+ * loop's own binding rather than a nested shadow of the same name. Shares
+ * `parseBoundedForLoop`'s initializer acceptance via `parseLoopInit`.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // for (let i = 0; i < 5; i++) → the `i` declaration identifier
+ *     const fn: typeof boundedLoopVarId = boundedLoopVarId;
+ *     void fn;
+ */
+export function boundedLoopVarId(node) {
+    return parseLoopInit(node)?.varId ?? null;
+}
+/**
+ * The accepted `for (let i = <numLit>; …)` initializer — a single-
+ * declaration `let`/`const` list whose name is an identifier with a
+ * numeric-literal start value — captured as both nodes, or `null`. The one
+ * place the initializer shape is recognised; `parseBoundedForLoop` and
+ * `boundedLoopVarId` both build on it (no narrowing casts in either).
+ */
+function parseLoopInit(node) {
+    const init = node.initializer;
+    if (!init || !ts.isVariableDeclarationList(init))
+        return null;
+    if (init.declarations.length !== 1)
+        return null;
+    const declaration = init.declarations[0];
+    if (!declaration || !ts.isIdentifier(declaration.name))
+        return null;
+    const start = declaration.initializer;
+    if (!start || !ts.isNumericLiteral(start))
+        return null;
+    return { varId: declaration.name, start };
+}
+/**
+ * Unwrap any number of nested parentheses around an expression. The Pine
+ * converter emits a historical bar offset as the parenthesised form
+ * `bar.point(-(N), …)` (see the converter's `anchorToWorldPoint`), so the
+ * lookback recogniser must peel the parens before matching the literal;
+ * the index-bound resolver does the same before matching a numeric leaf.
+ * Housed here — a leaf module with no analysis-package imports — so both
+ * `extractMaxLookback` and `resolveIndexBound` can share it without a
+ * circular import.
+ *
+ * @since 0.1
+ * @stable
+ * @example
+ *     // unwrapParens of `((7))` → the `7` numeric-literal node
+ *     const fn: typeof unwrapParens = unwrapParens;
+ *     void fn;
+ */
+export function unwrapParens(node) {
+    let current = node;
+    while (ts.isParenthesizedExpression(current))
+        current = current.expression;
+    return current;
+}
+//# sourceMappingURL=loopBounds.js.map

package/dist/analysis/loopBounds.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopBounds.js","sourceRoot":"","sources":["../../src/analysis/loopBounds.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,+DAA+D;AAE/D,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAA+B,IAAI,GAAG,CAAgB;IAC7E,EAAE,CAAC,UAAU,CAAC,aAAa;IAC3B,EAAE,CAAC,UAAU,CAAC,mBAAmB;IACjC,EAAE,CAAC,UAAU,CAAC,gBAAgB;IAC9B,EAAE,CAAC,UAAU,CAAC,sBAAsB;CACvC,CAAC,CAAC;AA2BH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAqB;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACrC,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClD,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO;QACH,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;QACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QAC9B,EAAE,EAAE,SAAS,CAAC,aAAa,CAAC,IAAI;QAChC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KACtC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqB;IAClD,OAAO,aAAa,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAClB,IAAqB;IAErB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;IAC9B,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC;IACtC,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY,CAAC,IAAmB;IAC5C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,yBAAyB,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IAC3E,OAAO,OAAO,CAAC;AACnB,CAAC","sourcesContent":["// Copyright (c) 2026 Invinite. Licensed under the MIT License.\n// See the LICENSE file in the repo root for full license text.\n\nimport ts from \"typescript\";\n\n/**\n * The comparison operators a legal chartlang `for` condition may use.\n * Shared by `parseBoundedForLoop` (which captures the operator so a sizer\n * can derive the loop's max index) and `forbiddenConstructs` (which rejects\n * any other condition shape) so the two passes recognise the same set.\n *\n * @since 0.1\n * @stable\n * @example\n *     COMPARISON_OPS.has(ts.SyntaxKind.LessThanToken); // → true\n */\nexport const COMPARISON_OPS: ReadonlySet<ts.SyntaxKind> = new Set<ts.SyntaxKind>([\n    ts.SyntaxKind.LessThanToken,\n    ts.SyntaxKind.LessThanEqualsToken,\n    ts.SyntaxKind.GreaterThanToken,\n    ts.SyntaxKind.GreaterThanEqualsToken,\n]);\n\n/**\n * The parsed shape of a legal chartlang `for` loop.\n *\n * @since 0.1\n * @stable\n * @example\n *     const loop: BoundedForLoop = {\n *         varName: \"i\",\n *         start: 0,\n *         op: ts.SyntaxKind.LessThanToken,\n *         limit: 5,\n *     };\n *     void loop;\n */\nexport type BoundedForLoop = Readonly<{\n    /** The induction variable name (the `i` in `for (let i = …)`). */\n    varName: string;\n    /** The literal initial value (`for (let i = <start>; …)`). */\n    start: number;\n    /** The comparison operator token used in the condition. */\n    op: ts.SyntaxKind;\n    /** The literal right-hand bound (`… i <op> <limit>; …`). */\n    limit: number;\n}>;\n\n/**\n * Parse a `ts.ForStatement` into its `BoundedForLoop` shape, or `null`\n * when it is not the one legal chartlang loop form\n * (`for (let i = <numLit>; i <comparison> <numLit>; i++)` — single\n * `let` init, id-on-left/literal-on-right condition, postfix `i++`).\n * The single source of truth for \"what is a bounded loop\"; both\n * `forbiddenConstructs` (reject everything else) and\n * `resolveIndexUpperBound` (size the index range) call it so the two\n * passes can never disagree.\n *\n * @since 0.1\n * @stable\n * @example\n *     // for (let i = 0; i < 5; i++) → { varName: \"i\", start: 0,\n *     //                                  op: LessThanToken, limit: 5 }\n *     const fn: typeof parseBoundedForLoop = parseBoundedForLoop;\n *     void fn;\n */\nexport function parseBoundedForLoop(node: ts.ForStatement): BoundedForLoop | null {\n    const init = parseLoopInit(node);\n    if (init === null) return null;\n    const condition = node.condition;\n    const incrementor = node.incrementor;\n    if (!condition || !incrementor) return null;\n    if (!ts.isBinaryExpression(condition)) return null;\n    if (!COMPARISON_OPS.has(condition.operatorToken.kind)) return null;\n    if (!ts.isNumericLiteral(condition.right)) return null;\n    if (!ts.isIdentifier(condition.left)) return null;\n    if (condition.left.text !== init.varId.text) return null;\n    if (!ts.isPostfixUnaryExpression(incrementor)) return null;\n    if (!ts.isIdentifier(incrementor.operand)) return null;\n    if (incrementor.operand.text !== init.varId.text) return null;\n    return {\n        varName: init.varId.text,\n        start: Number(init.start.text),\n        op: condition.operatorToken.kind,\n        limit: Number(condition.right.text),\n    };\n}\n\n/**\n * The induction variable's **declaration** identifier of the single legal\n * chartlang loop *initializer* shape, or `null` otherwise. A sizer calls\n * this directly when it needs the declaration node (not just the `varName`\n * text) to ask the type checker whether an index use resolves to this\n * loop's own binding rather than a nested shadow of the same name. Shares\n * `parseBoundedForLoop`'s initializer acceptance via `parseLoopInit`.\n *\n * @since 0.1\n * @stable\n * @example\n *     // for (let i = 0; i < 5; i++) → the `i` declaration identifier\n *     const fn: typeof boundedLoopVarId = boundedLoopVarId;\n *     void fn;\n */\nexport function boundedLoopVarId(node: ts.ForStatement): ts.Identifier | null {\n    return parseLoopInit(node)?.varId ?? null;\n}\n\n/**\n * The accepted `for (let i = <numLit>; …)` initializer — a single-\n * declaration `let`/`const` list whose name is an identifier with a\n * numeric-literal start value — captured as both nodes, or `null`. The one\n * place the initializer shape is recognised; `parseBoundedForLoop` and\n * `boundedLoopVarId` both build on it (no narrowing casts in either).\n */\nfunction parseLoopInit(\n    node: ts.ForStatement,\n): Readonly<{ varId: ts.Identifier; start: ts.NumericLiteral }> | null {\n    const init = node.initializer;\n    if (!init || !ts.isVariableDeclarationList(init)) return null;\n    if (init.declarations.length !== 1) return null;\n    const declaration = init.declarations[0];\n    if (!declaration || !ts.isIdentifier(declaration.name)) return null;\n    const start = declaration.initializer;\n    if (!start || !ts.isNumericLiteral(start)) return null;\n    return { varId: declaration.name, start };\n}\n\n/**\n * Unwrap any number of nested parentheses around an expression. The Pine\n * converter emits a historical bar offset as the parenthesised form\n * `bar.point(-(N), …)` (see the converter's `anchorToWorldPoint`), so the\n * lookback recogniser must peel the parens before matching the literal;\n * the index-bound resolver does the same before matching a numeric leaf.\n * Housed here — a leaf module with no analysis-package imports — so both\n * `extractMaxLookback` and `resolveIndexBound` can share it without a\n * circular import.\n *\n * @since 0.1\n * @stable\n * @example\n *     // unwrapParens of `((7))` → the `7` numeric-literal node\n *     const fn: typeof unwrapParens = unwrapParens;\n *     void fn;\n */\nexport function unwrapParens(node: ts.Expression): ts.Expression {\n    let current = node;\n    while (ts.isParenthesizedExpression(current)) current = current.expression;\n    return current;\n}\n"]}