@llui/compiler 0.5.1 → 0.5.3

package/dist/modules/opaque-state-flow.js

@@ -0,0 +1,240 @@
+// `opaque-state-flow` — errors when a reactive accessor's body flows
+// the state identifier into an expression the walker can't statically
+// trace. The compiler still produces a *correct* binding by forcing
+// FULL_MASK and emitting a whole-state `(s) => s` sentinel into
+// `__prefixes` (see `02 Compiler.md` § "Opaque-flow classifier"), but
+// the binding then re-evaluates on every state change rather than
+// only when its actual reads change. This rule surfaces the leak so
+// authors can either:
+//
+//   - Rewrite the accessor as direct property access (`s.foo`,
+//     `s.foo['literal']`), the form the walker can resolve.
+//   - Declare the reads explicitly via `track({ deps: (s) => [...] })`
+//     — the compile-time escape hatch the framework provides for cases
+//     where the read genuinely can't be expressed inline.
+//
+// Detected leak shapes (mirrors the classifier in
+// `transform.ts:computeAccessorMask`):
+//   - `helper(s)` with an Identifier callee that can't be resolved to
+//     a local declaration (function parameter, import, destructured
+//     binding) — the callee may read any field of `s`.
+//
+// NOT flagged (intentional): `obj.helper(s)` / `lib.fn(s)` —
+// PropertyAccessExpression callees. This is the documented headless-
+// components idiom (`pr.valueText(s)` where `pr` comes from
+// `progress.connect()`), and refactoring it defeats the API surface.
+// The runtime sentinel keeps such bindings correct — the cost is a
+// per-update re-evaluation, which is a property of the composition
+// pattern rather than an author mistake worth blocking.
+//   - `new Wrapper(s)` — NewExpression with state as an argument.
+//   - `` tag`${s}` `` — TaggedTemplate with state in a span.
+//   - `{ ...s }` / `[...s]` — spread of state.
+//   - `const x = s` — const aliasing.
+//   - `cond ? s : other` — state in a conditional branch (state
+//     reaches the binding via a path the walker can't trace).
+//   - `s[expr]` — dynamic element access (literal keys are tracked).
+//   - State passed as `arg1+` to any call (the existing delegation
+//     branch only inspects `arg0`).
+import ts from 'typescript';
+import { rangeFromOffsets } from '../diagnostic.js';
+import { isReactiveAccessor } from '../collect-deps.js';
+import { resolveAccessorBody } from '../accessor-resolver.js';
+// Mirrors the file-local list in collect-deps.ts. Calls to these
+// framework primitives are visited as accessor positions in their
+// own right, so we don't double-classify.
+const NON_DELEGATION_HELPERS = new Set(['sample', 'item', 'memo', 'text', 'unsafeHtml']);
+function findFirstLeakInAccessor(accessor, checker) {
+    if (accessor.parameters.length !== 1)
+        return null;
+    const param = accessor.parameters[0];
+    if (!ts.isIdentifier(param.name))
+        return null;
+    if (!accessor.body)
+        return null;
+    const stateParam = param.name.text;
+    let leak = null;
+    const visit = (node) => {
+        if (leak)
+            return;
+        if (ts.isIdentifier(node) && node.text === stateParam) {
+            const parent = node.parent;
+            if (!parent || ts.isParameter(parent)) {
+                ts.forEachChild(node, visit);
+                return;
+            }
+            // Tracked containers — the same set the mask classifier honors.
+            let tracked = false;
+            let shape = '';
+            let hint = '';
+            if (ts.isPropertyAccessExpression(parent) && parent.expression === node) {
+                tracked = true;
+            }
+            else if (ts.isElementAccessExpression(parent) && parent.expression === node) {
+                if (ts.isStringLiteralLike(parent.argumentExpression) ||
+                    ts.isNumericLiteral(parent.argumentExpression)) {
+                    tracked = true;
+                }
+                else {
+                    shape = `dynamic element access \`s[<expr>]\``;
+                    hint =
+                        'replace the dynamic key with a literal property (e.g. `s.foo`), or declare the read via `track({ deps: (s) => [s[key]] })`.';
+                }
+            }
+            else if (ts.isCallExpression(parent)) {
+                const argIndex = parent.arguments.indexOf(node);
+                if (argIndex > 0) {
+                    // State passed as arg1+ to a call. The header documents this
+                    // as NOT flagged (intentional): the existing delegation
+                    // branch only attempts to trace arg0, and the mask classifier
+                    // emits a whole-state sentinel into `__prefixes` so the
+                    // binding stays correct. The cost is per-update re-evaluation
+                    // — a property of the composition pattern, not an author
+                    // mistake worth blocking. Without this branch we'd fall
+                    // through to the default "outside a tracked container" leak.
+                    tracked = true;
+                }
+                else if (argIndex === 0) {
+                    if (ts.isIdentifier(parent.expression) &&
+                        !NON_DELEGATION_HELPERS.has(parent.expression.text)) {
+                        // Identifier-callee delegation. Recurse into the callee's
+                        // body via the same resolver the mask walker uses. If it
+                        // resolves to a local accessor, the helper's reads are
+                        // walked transitively and the call is tracked. If the
+                        // callee is a function parameter, import, destructured
+                        // binding, or otherwise unresolvable, this IS the leak
+                        // shape — flag it here so the diagnostic points at the
+                        // call site rather than at some deeper unresolvable read.
+                        const resolved = resolveAccessorBody(parent.expression, checker);
+                        if (resolved) {
+                            tracked = true;
+                        }
+                        else {
+                            const calleeSymbol = checker?.getSymbolAtLocation(parent.expression);
+                            const isFunctionParam = !!calleeSymbol?.declarations?.some((d) => ts.isParameter(d));
+                            shape = `call to an unresolvable callee \`${parent.expression.text}(s)\` (function parameter, import, or destructured binding)`;
+                            if (isFunctionParam) {
+                                hint =
+                                    'this callee is a function parameter — the closure passed at the call site is opaque to per-binding analysis. The framework expects per-row dynamic state to flow through `each` items (slot data on `item.*`) rather than through `(s) => ...` callback parameters; restructure the helper so its bindings read `item.*` and the call site builds the slot data once in `items: (s) => …`.';
+                            }
+                            else {
+                                hint =
+                                    'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.';
+                            }
+                        }
+                    }
+                    else if (!ts.isIdentifier(parent.expression)) {
+                        // Method-call / computed callee with state arg —
+                        // `obj.helper(s)`, `lib.fn(s)`. This is the documented
+                        // headless-components idiom (`pr.valueText(s)` where `pr`
+                        // comes from `progress.connect()`); refactoring it would
+                        // defeat the API surface. The runtime sentinel keeps the
+                        // binding correct — just at the cost of re-evaluating on
+                        // every update. Treat as tracked from the lint's POV so
+                        // legitimate composition doesn't error the build; the
+                        // perf cost is a property of the composition pattern, not
+                        // an author mistake worth blocking.
+                        tracked = true;
+                    }
+                }
+            }
+            else if (ts.isNewExpression(parent)) {
+                shape = 'state passed as a constructor argument (`new X(s)`)';
+                hint =
+                    'compute the derived value inline against direct state reads, or use `track({ deps: (s) => [...] })` to declare the reads.';
+            }
+            else if (ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent)) {
+                shape = 'state spread (`{...s}` / `[...s]`)';
+                hint =
+                    'spread only the fields you actually need (`{...s.user}`), or use `track({ deps: (s) => [...] })`.';
+            }
+            else if (ts.isVariableDeclaration(parent)) {
+                shape = 'const alias (`const x = s; … x.foo`)';
+                hint =
+                    'inline the alias to `s.foo`, or split the deeper read into a separate single-assignment alias `const foo = s.foo`.';
+            }
+            else if (ts.isConditionalExpression(parent)) {
+                shape = 'state in a conditional branch (`cond ? s : other`)';
+                hint = 'move the conditional inside the property access: `cond ? s.foo : other.foo`.';
+            }
+            else if (ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent)) {
+                shape = 'type assertion wrapping state (`(s as T).foo`)';
+                hint = 'drop the assertion — the chain `s.foo` already carries the type.';
+            }
+            else if (ts.isParenthesizedExpression(parent)) {
+                // Walk up through parens transparently. Don't flag here; the
+                // outer parent classifies.
+                ts.forEachChild(node, visit);
+                return;
+            }
+            else {
+                shape = `state used outside a tracked container (${describe(parent)})`;
+                hint =
+                    'restructure the expression so `s` appears only as the root of a property/element-access chain, or declare the read via `track({ deps: (s) => [...] })`.';
+            }
+            if (!tracked) {
+                leak = { node, shape, hint };
+                return;
+            }
+        }
+        ts.forEachChild(node, visit);
+    };
+    visit(accessor.body);
+    return leak;
+}
+function describe(node) {
+    if (ts.isIdentifier(node))
+        return node.text;
+    if (ts.isPropertyAccessExpression(node))
+        return `${describe(node.expression)}.${node.name.text}`;
+    return ts.SyntaxKind[node.kind];
+}
+export function opaqueStateFlowModule() {
+    return {
+        name: 'opaque-state-flow',
+        compilerVersion: '^0.3.0',
+        diagnostics: [
+            {
+                id: 'llui/opaque-state-flow',
+                description: "Reactive accessor flows state into an opaque expression the walker can't trace. The runtime stays correct via a FULL_MASK binding + whole-state sentinel in `__prefixes`, but the binding then re-evaluates on every state change.",
+            },
+        ],
+        visitors: {
+            [ts.SyntaxKind.SourceFile]: (ctx, node) => {
+                // When the host adapter has built a Program, walk the checker's
+                // own SourceFile so symbol resolution (Alias → Symbol via
+                // `getSymbolAtLocation`) actually works. The reparsed file used
+                // in the AST-only fallback is not part of any Program, so the
+                // checker can't resolve identifiers in it. Fall back to a
+                // reparse for paths without a Program (test harness, lint
+                // adapters without cross-file resolution).
+                const visited = node;
+                const fromProgram = ctx.program?.getSourceFile(visited.fileName);
+                const checker = fromProgram ? ctx.checker : undefined;
+                const sf = fromProgram ??
+                    ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true);
+                const walk = (n) => {
+                    if ((ts.isArrowFunction(n) || ts.isFunctionExpression(n)) && isReactiveAccessor(n)) {
+                        const leak = findFirstLeakInAccessor(n, checker);
+                        if (leak) {
+                            ctx.reportDiagnostic({
+                                id: 'llui/opaque-state-flow',
+                                severity: 'error',
+                                category: 'perf',
+                                message: `Reactive accessor flows state opaquely — ${leak.shape}. ` +
+                                    `The compiler ships a correct binding (FULL_MASK + whole-state sentinel), ` +
+                                    `but it re-evaluates on every state change. ${leak.hint}`,
+                                location: {
+                                    file: sf.fileName,
+                                    range: rangeFromOffsets(sf.text, leak.node.getStart(sf), leak.node.getEnd()),
+                                },
+                            });
+                        }
+                    }
+                    ts.forEachChild(n, walk);
+                };
+                walk(sf);
+            },
+        },
+    };
+}
+//# sourceMappingURL=opaque-state-flow.js.map

package/dist/modules/opaque-state-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque-state-flow.js","sourceRoot":"","sources":["../../src/modules/opaque-state-flow.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,uEAAuE;AACvE,uEAAuE;AACvE,0DAA0D;AAC1D,EAAE;AACF,kDAAkD;AAClD,uCAAuC;AACvC,sEAAsE;AACtE,oEAAoE;AACpE,uDAAuD;AACvD,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,4DAA4D;AAC5D,qEAAqE;AACrE,mEAAmE;AACnE,mEAAmE;AACnE,wDAAwD;AACxD,kEAAkE;AAClE,6DAA6D;AAC7D,+CAA+C;AAC/C,sCAAsC;AACtC,gEAAgE;AAChE,8DAA8D;AAC9D,qEAAqE;AACrE,mEAAmE;AACnE,oCAAoC;AAEpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAE7D,iEAAiE;AACjE,kEAAkE;AAClE,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;AAQxF,SAAS,uBAAuB,CAC9B,QAA2E,EAC3E,OAAmC;IAEnC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,CAAA;IACrC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;IAElC,IAAI,IAAI,GAAoB,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,IAAI;YAAE,OAAM;QAChB,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,gEAAgE;YAChE,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9E,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACjD,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC9C,CAAC;oBACD,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,sCAAsC,CAAA;oBAC9C,IAAI;wBACF,6HAA6H,CAAA;gBACjI,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAqB,CAAC,CAAA;gBAChE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,6DAA6D;oBAC7D,wDAAwD;oBACxD,8DAA8D;oBAC9D,wDAAwD;oBACxD,8DAA8D;oBAC9D,yDAAyD;oBACzD,wDAAwD;oBACxD,6DAA6D;oBAC7D,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;qBAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,IACE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;wBAClC,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EACnD,CAAC;wBACD,0DAA0D;wBAC1D,yDAAyD;wBACzD,uDAAuD;wBACvD,sDAAsD;wBACtD,uDAAuD;wBACvD,uDAAuD;wBACvD,uDAAuD;wBACvD,0DAA0D;wBAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBAChE,IAAI,QAAQ,EAAE,CAAC;4BACb,OAAO,GAAG,IAAI,CAAA;wBAChB,CAAC;6BAAM,CAAC;4BACN,MAAM,YAAY,GAAG,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BACpE,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAiB,EAAE,EAAE,CAC/E,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAClB,CAAA;4BACD,KAAK,GAAG,oCAAoC,MAAM,CAAC,UAAU,CAAC,IAAI,6DAA6D,CAAA;4BAC/H,IAAI,eAAe,EAAE,CAAC;gCACpB,IAAI;oCACF,4XAA4X,CAAA;4BAChY,CAAC;iCAAM,CAAC;gCACN,IAAI;oCACF,+KAA+K,CAAA;4BACnL,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,iDAAiD;wBACjD,uDAAuD;wBACvD,0DAA0D;wBAC1D,yDAAyD;wBACzD,yDAAyD;wBACzD,yDAAyD;wBACzD,wDAAwD;wBACxD,sDAAsD;wBACtD,0DAA0D;wBAC1D,oCAAoC;wBACpC,OAAO,GAAG,IAAI,CAAA;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,KAAK,GAAG,qDAAqD,CAAA;gBAC7D,IAAI;oBACF,2HAA2H,CAAA;YAC/H,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,KAAK,GAAG,oCAAoC,CAAA;gBAC5C,IAAI;oBACF,mGAAmG,CAAA;YACvG,CAAC;iBAAM,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,KAAK,GAAG,sCAAsC,CAAA;gBAC9C,IAAI;oBACF,oHAAoH,CAAA;YACxH,CAAC;iBAAM,IAAI,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,KAAK,GAAG,oDAAoD,CAAA;gBAC5D,IAAI,GAAG,8EAA8E,CAAA;YACvF,CAAC;iBAAM,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,KAAK,GAAG,gDAAgD,CAAA;gBACxD,IAAI,GAAG,kEAAkE,CAAA;YAC3E,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,6DAA6D;gBAC7D,2BAA2B;gBAC3B,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,2CAA2C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAA;gBACtE,IAAI;oBACF,yJAAyJ,CAAA;YAC7J,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;gBAC5B,OAAM;YACR,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IACD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACpB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC3C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAChG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE;YACX;gBACE,EAAE,EAAE,wBAAwB;gBAC5B,WAAW,EACT,oOAAoO;aACvO;SACF;QACD,QAAQ,EAAE;YACR,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBACxC,gEAAgE;gBAChE,0DAA0D;gBAC1D,gEAAgE;gBAChE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,0DAA0D;gBAC1D,2CAA2C;gBAC3C,MAAM,OAAO,GAAG,IAAqB,CAAA;gBACrC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAChE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;gBACrD,MAAM,EAAE,GACN,WAAW;oBACX,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBAEnF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;oBAChC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnF,MAAM,IAAI,GAAG,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;wBAChD,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,gBAAgB,CAAC;gCACnB,EAAE,EAAE,wBAAwB;gCAC5B,QAAQ,EAAE,OAAO;gCACjB,QAAQ,EAAE,MAAM;gCAChB,OAAO,EACL,4CAA4C,IAAI,CAAC,KAAK,IAAI;oCAC1D,2EAA2E;oCAC3E,8CAA8C,IAAI,CAAC,IAAI,EAAE;gCAC3D,QAAQ,EAAE;oCACR,IAAI,EAAE,EAAE,CAAC,QAAQ;oCACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;iCAC7E;6BACF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;oBACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC1B,CAAC,CAAA;gBACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACV,CAAC;SACF;KACF,CAAA;AACH,CAAC","sourcesContent":["// `opaque-state-flow` — errors when a reactive accessor's body flows\n// the state identifier into an expression the walker can't statically\n// trace. The compiler still produces a *correct* binding by forcing\n// FULL_MASK and emitting a whole-state `(s) => s` sentinel into\n// `__prefixes` (see `02 Compiler.md` § \"Opaque-flow classifier\"), but\n// the binding then re-evaluates on every state change rather than\n// only when its actual reads change. This rule surfaces the leak so\n// authors can either:\n//\n//   - Rewrite the accessor as direct property access (`s.foo`,\n//     `s.foo['literal']`), the form the walker can resolve.\n//   - Declare the reads explicitly via `track({ deps: (s) => [...] })`\n//     — the compile-time escape hatch the framework provides for cases\n//     where the read genuinely can't be expressed inline.\n//\n// Detected leak shapes (mirrors the classifier in\n// `transform.ts:computeAccessorMask`):\n//   - `helper(s)` with an Identifier callee that can't be resolved to\n//     a local declaration (function parameter, import, destructured\n//     binding) — the callee may read any field of `s`.\n//\n// NOT flagged (intentional): `obj.helper(s)` / `lib.fn(s)` —\n// PropertyAccessExpression callees. This is the documented headless-\n// components idiom (`pr.valueText(s)` where `pr` comes from\n// `progress.connect()`), and refactoring it defeats the API surface.\n// The runtime sentinel keeps such bindings correct — the cost is a\n// per-update re-evaluation, which is a property of the composition\n// pattern rather than an author mistake worth blocking.\n//   - `new Wrapper(s)` — NewExpression with state as an argument.\n//   - `` tag`${s}` `` — TaggedTemplate with state in a span.\n//   - `{ ...s }` / `[...s]` — spread of state.\n//   - `const x = s` — const aliasing.\n//   - `cond ? s : other` — state in a conditional branch (state\n//     reaches the binding via a path the walker can't trace).\n//   - `s[expr]` — dynamic element access (literal keys are tracked).\n//   - State passed as `arg1+` to any call (the existing delegation\n//     branch only inspects `arg0`).\n\nimport ts from 'typescript'\nimport { rangeFromOffsets } from '../diagnostic.js'\nimport type { CompilerModule } from '../module.js'\nimport { isReactiveAccessor } from '../collect-deps.js'\nimport { resolveAccessorBody } from '../accessor-resolver.js'\n\n// Mirrors the file-local list in collect-deps.ts. Calls to these\n// framework primitives are visited as accessor positions in their\n// own right, so we don't double-classify.\nconst NON_DELEGATION_HELPERS = new Set(['sample', 'item', 'memo', 'text', 'unsafeHtml'])\n\ninterface LeakSite {\n  node: ts.Node\n  shape: string\n  hint: string\n}\n\nfunction findFirstLeakInAccessor(\n  accessor: ts.ArrowFunction | ts.FunctionExpression | ts.FunctionDeclaration,\n  checker: ts.TypeChecker | undefined,\n): LeakSite | null {\n  if (accessor.parameters.length !== 1) return null\n  const param = accessor.parameters[0]!\n  if (!ts.isIdentifier(param.name)) return null\n  if (!accessor.body) return null\n  const stateParam = param.name.text\n\n  let leak: LeakSite | null = null\n  const visit = (node: ts.Node): void => {\n    if (leak) return\n    if (ts.isIdentifier(node) && node.text === stateParam) {\n      const parent = node.parent\n      if (!parent || ts.isParameter(parent)) {\n        ts.forEachChild(node, visit)\n        return\n      }\n      // Tracked containers — the same set the mask classifier honors.\n      let tracked = false\n      let shape = ''\n      let hint = ''\n      if (ts.isPropertyAccessExpression(parent) && parent.expression === node) {\n        tracked = true\n      } else if (ts.isElementAccessExpression(parent) && parent.expression === node) {\n        if (\n          ts.isStringLiteralLike(parent.argumentExpression) ||\n          ts.isNumericLiteral(parent.argumentExpression)\n        ) {\n          tracked = true\n        } else {\n          shape = `dynamic element access \\`s[<expr>]\\``\n          hint =\n            'replace the dynamic key with a literal property (e.g. `s.foo`), or declare the read via `track({ deps: (s) => [s[key]] })`.'\n        }\n      } else if (ts.isCallExpression(parent)) {\n        const argIndex = parent.arguments.indexOf(node as ts.Expression)\n        if (argIndex > 0) {\n          // State passed as arg1+ to a call. The header documents this\n          // as NOT flagged (intentional): the existing delegation\n          // branch only attempts to trace arg0, and the mask classifier\n          // emits a whole-state sentinel into `__prefixes` so the\n          // binding stays correct. The cost is per-update re-evaluation\n          // — a property of the composition pattern, not an author\n          // mistake worth blocking. Without this branch we'd fall\n          // through to the default \"outside a tracked container\" leak.\n          tracked = true\n        } else if (argIndex === 0) {\n          if (\n            ts.isIdentifier(parent.expression) &&\n            !NON_DELEGATION_HELPERS.has(parent.expression.text)\n          ) {\n            // Identifier-callee delegation. Recurse into the callee's\n            // body via the same resolver the mask walker uses. If it\n            // resolves to a local accessor, the helper's reads are\n            // walked transitively and the call is tracked. If the\n            // callee is a function parameter, import, destructured\n            // binding, or otherwise unresolvable, this IS the leak\n            // shape — flag it here so the diagnostic points at the\n            // call site rather than at some deeper unresolvable read.\n            const resolved = resolveAccessorBody(parent.expression, checker)\n            if (resolved) {\n              tracked = true\n            } else {\n              const calleeSymbol = checker?.getSymbolAtLocation(parent.expression)\n              const isFunctionParam = !!calleeSymbol?.declarations?.some((d: ts.Declaration) =>\n                ts.isParameter(d),\n              )\n              shape = `call to an unresolvable callee \\`${parent.expression.text}(s)\\` (function parameter, import, or destructured binding)`\n              if (isFunctionParam) {\n                hint =\n                  'this callee is a function parameter — the closure passed at the call site is opaque to per-binding analysis. The framework expects per-row dynamic state to flow through `each` items (slot data on `item.*`) rather than through `(s) => ...` callback parameters; restructure the helper so its bindings read `item.*` and the call site builds the slot data once in `items: (s) => …`.'\n              } else {\n                hint =\n                  'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.'\n              }\n            }\n          } else if (!ts.isIdentifier(parent.expression)) {\n            // Method-call / computed callee with state arg —\n            // `obj.helper(s)`, `lib.fn(s)`. This is the documented\n            // headless-components idiom (`pr.valueText(s)` where `pr`\n            // comes from `progress.connect()`); refactoring it would\n            // defeat the API surface. The runtime sentinel keeps the\n            // binding correct — just at the cost of re-evaluating on\n            // every update. Treat as tracked from the lint's POV so\n            // legitimate composition doesn't error the build; the\n            // perf cost is a property of the composition pattern, not\n            // an author mistake worth blocking.\n            tracked = true\n          }\n        }\n      } else if (ts.isNewExpression(parent)) {\n        shape = 'state passed as a constructor argument (`new X(s)`)'\n        hint =\n          'compute the derived value inline against direct state reads, or use `track({ deps: (s) => [...] })` to declare the reads.'\n      } else if (ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent)) {\n        shape = 'state spread (`{...s}` / `[...s]`)'\n        hint =\n          'spread only the fields you actually need (`{...s.user}`), or use `track({ deps: (s) => [...] })`.'\n      } else if (ts.isVariableDeclaration(parent)) {\n        shape = 'const alias (`const x = s; … x.foo`)'\n        hint =\n          'inline the alias to `s.foo`, or split the deeper read into a separate single-assignment alias `const foo = s.foo`.'\n      } else if (ts.isConditionalExpression(parent)) {\n        shape = 'state in a conditional branch (`cond ? s : other`)'\n        hint = 'move the conditional inside the property access: `cond ? s.foo : other.foo`.'\n      } else if (ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent)) {\n        shape = 'type assertion wrapping state (`(s as T).foo`)'\n        hint = 'drop the assertion — the chain `s.foo` already carries the type.'\n      } else if (ts.isParenthesizedExpression(parent)) {\n        // Walk up through parens transparently. Don't flag here; the\n        // outer parent classifies.\n        ts.forEachChild(node, visit)\n        return\n      } else {\n        shape = `state used outside a tracked container (${describe(parent)})`\n        hint =\n          'restructure the expression so `s` appears only as the root of a property/element-access chain, or declare the read via `track({ deps: (s) => [...] })`.'\n      }\n      if (!tracked) {\n        leak = { node, shape, hint }\n        return\n      }\n    }\n    ts.forEachChild(node, visit)\n  }\n  visit(accessor.body)\n  return leak\n}\n\nfunction describe(node: ts.Node): string {\n  if (ts.isIdentifier(node)) return node.text\n  if (ts.isPropertyAccessExpression(node)) return `${describe(node.expression)}.${node.name.text}`\n  return ts.SyntaxKind[node.kind]\n}\n\nexport function opaqueStateFlowModule(): CompilerModule {\n  return {\n    name: 'opaque-state-flow',\n    compilerVersion: '^0.3.0',\n    diagnostics: [\n      {\n        id: 'llui/opaque-state-flow',\n        description:\n          \"Reactive accessor flows state into an opaque expression the walker can't trace. The runtime stays correct via a FULL_MASK binding + whole-state sentinel in `__prefixes`, but the binding then re-evaluates on every state change.\",\n      },\n    ],\n    visitors: {\n      [ts.SyntaxKind.SourceFile]: (ctx, node) => {\n        // When the host adapter has built a Program, walk the checker's\n        // own SourceFile so symbol resolution (Alias → Symbol via\n        // `getSymbolAtLocation`) actually works. The reparsed file used\n        // in the AST-only fallback is not part of any Program, so the\n        // checker can't resolve identifiers in it. Fall back to a\n        // reparse for paths without a Program (test harness, lint\n        // adapters without cross-file resolution).\n        const visited = node as ts.SourceFile\n        const fromProgram = ctx.program?.getSourceFile(visited.fileName)\n        const checker = fromProgram ? ctx.checker : undefined\n        const sf =\n          fromProgram ??\n          ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true)\n\n        const walk = (n: ts.Node): void => {\n          if ((ts.isArrowFunction(n) || ts.isFunctionExpression(n)) && isReactiveAccessor(n)) {\n            const leak = findFirstLeakInAccessor(n, checker)\n            if (leak) {\n              ctx.reportDiagnostic({\n                id: 'llui/opaque-state-flow',\n                severity: 'error',\n                category: 'perf',\n                message:\n                  `Reactive accessor flows state opaquely — ${leak.shape}. ` +\n                  `The compiler ships a correct binding (FULL_MASK + whole-state sentinel), ` +\n                  `but it re-evaluates on every state change. ${leak.hint}`,\n                location: {\n                  file: sf.fileName,\n                  range: rangeFromOffsets(sf.text, leak.node.getStart(sf), leak.node.getEnd()),\n                },\n              })\n            }\n          }\n          ts.forEachChild(n, walk)\n        }\n        walk(sf)\n      },\n    },\n  }\n}\n"]}

package/dist/transform.d.ts

@@ -56,7 +56,7 @@ export interface PreExtractedSchemas {
     stateSchema?: ReturnType<typeof extractStateSchema>;
     effectSchema?: ReturnType<typeof extractEffectSchema>;
 }
-export declare function transformLlui(source: string, _filename: string, devMode?: boolean, emitAgentMetadata?: boolean, mcpPort?: number | null, verbose?: boolean, typeSources?: ExternalTypeSources, preExtracted?: PreExtractedSchemas, crossFilePaths?: ReadonlySet<string>): {
+export declare function transformLlui(source: string, _filename: string, devMode?: boolean, emitAgentMetadata?: boolean, mcpPort?: number | null, verbose?: boolean, typeSources?: ExternalTypeSources, preExtracted?: PreExtractedSchemas, crossFilePaths?: ReadonlySet<string>, crossFileOpaque?: boolean, crossFileProgram?: ts.Program): {
     output: string;
     edits: TransformEdit[];
     diagnostics: Diagnostic[];

package/dist/transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../src/transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAiCjD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAQhF;AAwED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAC/C,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IACzD,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;CACtD;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,EACf,iBAAiB,UAAQ,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,OAAO,UAAQ,EACf,WAAW,CAAC,EAAE,mBAAmB,EACjC,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,IAAI,CAywB9E;AA2cD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,UAAU,EAAE,EAAE,CAAC,iBAAiB,GAC/B,OAAO,CAUT;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,EAAE,CAAC,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAgBT;AAgLD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,mBAAmB,EAC3E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAa,EACjC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAkHvD;AAkBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAcrF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CASzF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CAYR"}
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../src/transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAiCjD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAQhF;AAwED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAC/C,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IACzD,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;CACtD;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,EACf,iBAAiB,UAAQ,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,OAAO,UAAQ,EACf,WAAW,CAAC,EAAE,mBAAmB,EACjC,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,UAAQ,EACvB,gBAAgB,CAAC,EAAE,EAAE,CAAC,OAAO,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,IAAI,CA0xB9E;AA2cD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,UAAU,EAAE,EAAE,CAAC,iBAAiB,GAC/B,OAAO,CAUT;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,EAAE,CAAC,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAgBT;AAgLD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,mBAAmB,EAC3E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAa,EACjC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAiLvD;AAkBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAcrF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CASzF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CAYR"}

package/dist/transform.js

@@ -104,7 +104,7 @@ const ELEMENT_HELPERS = new Set([
     'ul',
     'video',
 ]);
-export function transformLlui(source, _filename, devMode = false, emitAgentMetadata = false, mcpPort = 5200, verbose = false, typeSources, preExtracted, crossFilePaths) {
+export function transformLlui(source, _filename, devMode = false, emitAgentMetadata = false, mcpPort = 5200, verbose = false, typeSources, preExtracted, crossFilePaths, crossFileOpaque = false, crossFileProgram) {
     // Use the caller-provided filename so any module reading `sf.fileName`
     // (e.g. `componentMetaModule` emitting `__componentMeta: { file }`)
     // sees the real path instead of a placeholder. The monolith's inline
@@ -164,9 +164,13 @@ export function transformLlui(source, _filename, devMode = false, emitAgentMetad
     // function is generated per-component, so bit assignments in other files
     // won't match. Files without component() get FULL_MASK on all bindings.
     const fileHasComponent = hasComponentDef(sourceFile, lluiImport);
-    const { lo: fieldBits, hi: fieldBitsHi } = fileHasComponent
+    const { lo: fieldBits, hi: fieldBitsHi, opaque: fileLocalOpaque, } = fileHasComponent
         ? collectDeps(source, crossFilePaths)
-        : { lo: new Map(), hi: new Map() };
+        : { lo: new Map(), hi: new Map(), opaque: false };
+    // Union the file-local opaque flag with the cross-file flag from the
+    // vite-plugin's walker — either can independently mandate a
+    // whole-state sentinel in `__prefixes`.
+    const hasOpaqueAccessor = fileLocalOpaque || crossFileOpaque;
     if (verbose && fileHasComponent) {
         const pairs = [...fieldBits.entries()]
             .map(([path, bit]) => `${path}=${bit === -1 ? 'FULL' : bit}`)
@@ -357,6 +361,7 @@ export function transformLlui(source, _filename, devMode = false, emitAgentMetad
         fieldBits,
         fieldBitsHi,
         lluiImport,
+        hasOpaqueAccessor,
     }));
     // structuralMaskModule injects `__mask` into each()/branch()/scope()/show()
     // options. Activated when the file has any low-word reactive paths
@@ -386,7 +391,15 @@ export function transformLlui(source, _filename, devMode = false, emitAgentMetad
     // `typeSources` flows through to lint modules that need cross-file
     // visibility (e.g. agent-emits-drift's imported-Msg case). Same
     // shape as `ModuleExternalTypes`.
-    const registryResult = registry.run(sourceFile, undefined, typeSources);
+    // Cross-file Program (when the host adapter supplied one) flows through
+    // to lint modules that need to resolve identifiers across files — e.g.
+    // opaque-state-flow walking through an imported helper to decide
+    // whether `helper(s)` is a tracked delegation or an opaque leak. The
+    // checker derived here is the one bound to that Program; identifiers
+    // in `crossFileProgram.getSourceFile(_filename)` resolve through it,
+    // identifiers in the locally-reparsed `sourceFile` do not.
+    const crossFileChecker = crossFileProgram?.getTypeChecker();
+    const registryResult = registry.run(sourceFile, crossFileChecker, typeSources, crossFileProgram);
     // The registry phases (preTransform v2c/decomp-7, transformCall
     // v2c/decomp-11/12) may have mutated the source file — replace our
     // local reference so all subsequent code (fieldBits, visitor,
@@ -1356,6 +1369,15 @@ export function computeAccessorMask(accessor, fieldBits, visited = new Set(), fi
     let mask = 0;
     let maskHi = 0;
     let readsState = false;
+    // The state value flows into an expression we can't statically trace
+    // (function-arg / imported / destructured / method callee, or a
+    // dynamic `s[expr]` lookup). The callee may read any field; the
+    // dynamic key may index any field. Any non-empty precise mask we'd
+    // compute from the visible direct reads alone is "clean but wrong":
+    // a reducer that narrowly touches only the opaquely-read field
+    // produces a dirty bit that `mask & dirty` zeroes, silently skipping
+    // the binding. Conservative correctness: bail to FULL_MASK.
+    let opaqueStateFlow = false;
     // `inNestedFn` gates only the delegation-recursion. Property-access
     // path extraction happens everywhere — inner-arrow callbacks like
     // `s.items.filter((i) => i.includes(s.filter))` close over our
@@ -1369,8 +1391,48 @@ export function computeAccessorMask(accessor, fieldBits, visited = new Set(), fi
         // like `text((_s) => \`$${item.x.toLocaleString()}\`)` was how
         // this bug first surfaced in the persistent-layout example work.
         const parent = node.parent;
-        if (ts.isIdentifier(node) && node.text === stateParam && (!parent || !ts.isParameter(parent))) {
-            readsState = true;
+        // Every appearance of the state identifier `s` is one of:
+        //   - the parameter binding itself                       — ignore
+        //   - the root of `s.x.y…`  (PropertyAccessExpression)  — tracked by the PAE walker
+        //   - the root of `s['literal']`/`s[0]`                 — tracked by element-access (literal key only)
+        //   - arg0 of `helper(s)` with an Identifier callee     — handled by the delegation branch below
+        //   - anything else (spread, return, ternary branch, template span,
+        //     NewExpression arg, TaggedTemplate value, const alias, arg1+ of any call,
+        //     method-call arg `obj.f(s)`, dynamic key `s[expr]`, type assertion,
+        //     parenthesized, …)                                 — opaque: state has leaked
+        //
+        // The leak cases can't be reasoned about statically — the receiver
+        // may read any field of `s`. A "precise" mask built from sibling
+        // direct reads alone hides every field reachable only through the
+        // leak, and (mask & dirty) silently skips updates. Conservative
+        // correctness: any opaque flow forces FULL_MASK.
+        if (ts.isIdentifier(node) && node.text === stateParam) {
+            const isBinding = !!parent && ts.isParameter(parent);
+            if (!isBinding) {
+                readsState = true;
+                let isTracked = false;
+                if (parent) {
+                    if (ts.isPropertyAccessExpression(parent) && parent.expression === node) {
+                        isTracked = true;
+                    }
+                    else if (ts.isElementAccessExpression(parent) && parent.expression === node) {
+                        isTracked =
+                            ts.isStringLiteralLike(parent.argumentExpression) ||
+                                ts.isNumericLiteral(parent.argumentExpression);
+                    }
+                    else if (ts.isCallExpression(parent) &&
+                        ts.isIdentifier(parent.expression) &&
+                        parent.arguments[0] === node &&
+                        !NON_DELEGATION_HELPERS.has(parent.expression.text)) {
+                        // The delegation branch below either recurses into the
+                        // resolved body or sets opaqueStateFlow explicitly when
+                        // unresolvable — don't pre-empt that decision here.
+                        isTracked = true;
+                    }
+                }
+                if (!isTracked)
+                    opaqueStateFlow = true;
+            }
         }
         if (ts.isPropertyAccessExpression(node)) {
             // When there's no parent we can't tell if this is the top of a
@@ -1437,6 +1499,14 @@ export function computeAccessorMask(accessor, fieldBits, visited = new Set(), fi
                         if (inner.readsState)
                             readsState = true;
                     }
+                    else {
+                        // Callee is a function parameter, imported binding, or
+                        // destructured local — `resolveAccessorBody` couldn't pin
+                        // it to a local declaration. The body could read any
+                        // field of `s`, so a precise mask from sibling direct
+                        // reads alone is unsafe.
+                        opaqueStateFlow = true;
+                    }
                 }
             }
         }
@@ -1444,6 +1514,14 @@ export function computeAccessorMask(accessor, fieldBits, visited = new Set(), fi
         ts.forEachChild(node, (child) => walk(child, inNestedFn || enteringNested));
     }
     walk(accessor.body, false);
+    if (opaqueStateFlow) {
+        // Both words FULL_MASK: the whole-state sentinel emitted by
+        // `core-synthesis.ts:buildPrefixesProp` may land in either the
+        // low or high word depending on the file's prefix count. The
+        // runtime gate `(mask & dirty) | (maskHi & dirtyHi)` only catches
+        // the sentinel bit when the binding's mask covers BOTH words.
+        return { mask: 0xffffffff | 0, maskHi: 0xffffffff | 0, readsState: true };
+    }
     if (mask === 0 && maskHi === 0 && readsState) {
         return { mask: 0xffffffff | 0, maskHi: 0, readsState: true };
     }