@llui/compiler 0.5.2 → 0.5.3

package/dist/modules/opaque-state-flow.js

@@ -43,7 +43,7 @@ import { resolveAccessorBody } from '../accessor-resolver.js';
 // framework primitives are visited as accessor positions in their
 // own right, so we don't double-classify.
 const NON_DELEGATION_HELPERS = new Set(['sample', 'item', 'memo', 'text', 'unsafeHtml']);
-function findFirstLeakInAccessor(accessor) {
+function findFirstLeakInAccessor(accessor, checker) {
     if (accessor.parameters.length !== 1)
         return null;
     const param = accessor.parameters[0];
@@ -80,40 +80,62 @@ function findFirstLeakInAccessor(accessor) {
                         'replace the dynamic key with a literal property (e.g. `s.foo`), or declare the read via `track({ deps: (s) => [s[key]] })`.';
                 }
             }
-            else if (ts.isCallExpression(parent) && parent.arguments[0] === node) {
-                if (ts.isIdentifier(parent.expression) &&
-                    !NON_DELEGATION_HELPERS.has(parent.expression.text)) {
-                    // Identifier-callee delegation. Recurse into the callee's
-                    // body via the same resolver the mask walker uses. If it
-                    // resolves to a local accessor, the helper's reads are
-                    // walked transitively and the call is tracked. If the
-                    // callee is a function parameter, import, destructured
-                    // binding, or otherwise unresolvable, this IS the leak
-                    // shape — flag it here so the diagnostic points at the
-                    // call site rather than at some deeper unresolvable read.
-                    const resolved = resolveAccessorBody(parent.expression);
-                    if (resolved) {
-                        tracked = true;
+            else if (ts.isCallExpression(parent)) {
+                const argIndex = parent.arguments.indexOf(node);
+                if (argIndex > 0) {
+                    // State passed as arg1+ to a call. The header documents this
+                    // as NOT flagged (intentional): the existing delegation
+                    // branch only attempts to trace arg0, and the mask classifier
+                    // emits a whole-state sentinel into `__prefixes` so the
+                    // binding stays correct. The cost is per-update re-evaluation
+                    // — a property of the composition pattern, not an author
+                    // mistake worth blocking. Without this branch we'd fall
+                    // through to the default "outside a tracked container" leak.
+                    tracked = true;
+                }
+                else if (argIndex === 0) {
+                    if (ts.isIdentifier(parent.expression) &&
+                        !NON_DELEGATION_HELPERS.has(parent.expression.text)) {
+                        // Identifier-callee delegation. Recurse into the callee's
+                        // body via the same resolver the mask walker uses. If it
+                        // resolves to a local accessor, the helper's reads are
+                        // walked transitively and the call is tracked. If the
+                        // callee is a function parameter, import, destructured
+                        // binding, or otherwise unresolvable, this IS the leak
+                        // shape — flag it here so the diagnostic points at the
+                        // call site rather than at some deeper unresolvable read.
+                        const resolved = resolveAccessorBody(parent.expression, checker);
+                        if (resolved) {
+                            tracked = true;
+                        }
+                        else {
+                            const calleeSymbol = checker?.getSymbolAtLocation(parent.expression);
+                            const isFunctionParam = !!calleeSymbol?.declarations?.some((d) => ts.isParameter(d));
+                            shape = `call to an unresolvable callee \`${parent.expression.text}(s)\` (function parameter, import, or destructured binding)`;
+                            if (isFunctionParam) {
+                                hint =
+                                    'this callee is a function parameter — the closure passed at the call site is opaque to per-binding analysis. The framework expects per-row dynamic state to flow through `each` items (slot data on `item.*`) rather than through `(s) => ...` callback parameters; restructure the helper so its bindings read `item.*` and the call site builds the slot data once in `items: (s) => …`.';
+                            }
+                            else {
+                                hint =
+                                    'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.';
+                            }
+                        }
                     }
-                    else {
-                        shape = `call to an unresolvable callee \`${parent.expression.text}(s)\` (function parameter, import, or destructured binding)`;
-                        hint =
-                            'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.';
+                    else if (!ts.isIdentifier(parent.expression)) {
+                        // Method-call / computed callee with state arg —
+                        // `obj.helper(s)`, `lib.fn(s)`. This is the documented
+                        // headless-components idiom (`pr.valueText(s)` where `pr`
+                        // comes from `progress.connect()`); refactoring it would
+                        // defeat the API surface. The runtime sentinel keeps the
+                        // binding correct — just at the cost of re-evaluating on
+                        // every update. Treat as tracked from the lint's POV so
+                        // legitimate composition doesn't error the build; the
+                        // perf cost is a property of the composition pattern, not
+                        // an author mistake worth blocking.
+                        tracked = true;
                     }
                 }
-                else if (!ts.isIdentifier(parent.expression)) {
-                    // Method-call / computed callee with state arg —
-                    // `obj.helper(s)`, `lib.fn(s)`. This is the documented
-                    // headless-components idiom (`pr.valueText(s)` where `pr`
-                    // comes from `progress.connect()`); refactoring it would
-                    // defeat the API surface. The runtime sentinel keeps the
-                    // binding correct — just at the cost of re-evaluating on
-                    // every update. Treat as tracked from the lint's POV so
-                    // legitimate composition doesn't error the build; the
-                    // perf cost is a property of the composition pattern, not
-                    // an author mistake worth blocking.
-                    tracked = true;
-                }
             }
             else if (ts.isNewExpression(parent)) {
                 shape = 'state passed as a constructor argument (`new X(s)`)';
@@ -178,11 +200,21 @@ export function opaqueStateFlowModule() {
         ],
         visitors: {
             [ts.SyntaxKind.SourceFile]: (ctx, node) => {
+                // When the host adapter has built a Program, walk the checker's
+                // own SourceFile so symbol resolution (Alias → Symbol via
+                // `getSymbolAtLocation`) actually works. The reparsed file used
+                // in the AST-only fallback is not part of any Program, so the
+                // checker can't resolve identifiers in it. Fall back to a
+                // reparse for paths without a Program (test harness, lint
+                // adapters without cross-file resolution).
                 const visited = node;
-                const sf = ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true);
+                const fromProgram = ctx.program?.getSourceFile(visited.fileName);
+                const checker = fromProgram ? ctx.checker : undefined;
+                const sf = fromProgram ??
+                    ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true);
                 const walk = (n) => {
                     if ((ts.isArrowFunction(n) || ts.isFunctionExpression(n)) && isReactiveAccessor(n)) {
-                        const leak = findFirstLeakInAccessor(n);
+                        const leak = findFirstLeakInAccessor(n, checker);
                         if (leak) {
                             ctx.reportDiagnostic({
                                 id: 'llui/opaque-state-flow',

package/dist/modules/opaque-state-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"opaque-state-flow.js","sourceRoot":"","sources":["../../src/modules/opaque-state-flow.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,uEAAuE;AACvE,uEAAuE;AACvE,0DAA0D;AAC1D,EAAE;AACF,kDAAkD;AAClD,uCAAuC;AACvC,sEAAsE;AACtE,oEAAoE;AACpE,uDAAuD;AACvD,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,4DAA4D;AAC5D,qEAAqE;AACrE,mEAAmE;AACnE,mEAAmE;AACnE,wDAAwD;AACxD,kEAAkE;AAClE,6DAA6D;AAC7D,+CAA+C;AAC/C,sCAAsC;AACtC,gEAAgE;AAChE,8DAA8D;AAC9D,qEAAqE;AACrE,mEAAmE;AACnE,oCAAoC;AAEpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAE7D,iEAAiE;AACjE,kEAAkE;AAClE,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;AAQxF,SAAS,uBAAuB,CAC9B,QAA2E;IAE3E,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,CAAA;IACrC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;IAElC,IAAI,IAAI,GAAoB,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,IAAI;YAAE,OAAM;QAChB,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,gEAAgE;YAChE,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9E,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACjD,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC9C,CAAC;oBACD,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,sCAAsC,CAAA;oBAC9C,IAAI;wBACF,6HAA6H,CAAA;gBACjI,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvE,IACE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;oBAClC,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EACnD,CAAC;oBACD,0DAA0D;oBAC1D,yDAAyD;oBACzD,uDAAuD;oBACvD,sDAAsD;oBACtD,uDAAuD;oBACvD,uDAAuD;oBACvD,uDAAuD;oBACvD,0DAA0D;oBAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;oBACvD,IAAI,QAAQ,EAAE,CAAC;wBACb,OAAO,GAAG,IAAI,CAAA;oBAChB,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,oCAAoC,MAAM,CAAC,UAAU,CAAC,IAAI,6DAA6D,CAAA;wBAC/H,IAAI;4BACF,+KAA+K,CAAA;oBACnL,CAAC;gBACH,CAAC;qBAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC/C,iDAAiD;oBACjD,uDAAuD;oBACvD,0DAA0D;oBAC1D,yDAAyD;oBACzD,yDAAyD;oBACzD,yDAAyD;oBACzD,wDAAwD;oBACxD,sDAAsD;oBACtD,0DAA0D;oBAC1D,oCAAoC;oBACpC,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,KAAK,GAAG,qDAAqD,CAAA;gBAC7D,IAAI;oBACF,2HAA2H,CAAA;YAC/H,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,KAAK,GAAG,oCAAoC,CAAA;gBAC5C,IAAI;oBACF,mGAAmG,CAAA;YACvG,CAAC;iBAAM,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,KAAK,GAAG,sCAAsC,CAAA;gBAC9C,IAAI;oBACF,oHAAoH,CAAA;YACxH,CAAC;iBAAM,IAAI,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,KAAK,GAAG,oDAAoD,CAAA;gBAC5D,IAAI,GAAG,8EAA8E,CAAA;YACvF,CAAC;iBAAM,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,KAAK,GAAG,gDAAgD,CAAA;gBACxD,IAAI,GAAG,kEAAkE,CAAA;YAC3E,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,6DAA6D;gBAC7D,2BAA2B;gBAC3B,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,2CAA2C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAA;gBACtE,IAAI;oBACF,yJAAyJ,CAAA;YAC7J,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;gBAC5B,OAAM;YACR,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IACD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACpB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC3C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAChG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE;YACX;gBACE,EAAE,EAAE,wBAAwB;gBAC5B,WAAW,EACT,oOAAoO;aACvO;SACF;QACD,QAAQ,EAAE;YACR,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,IAAqB,CAAA;gBACrC,MAAM,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBAE5F,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;oBAChC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnF,MAAM,IAAI,GAAG,uBAAuB,CAAC,CAAC,CAAC,CAAA;wBACvC,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,gBAAgB,CAAC;gCACnB,EAAE,EAAE,wBAAwB;gCAC5B,QAAQ,EAAE,OAAO;gCACjB,QAAQ,EAAE,MAAM;gCAChB,OAAO,EACL,4CAA4C,IAAI,CAAC,KAAK,IAAI;oCAC1D,2EAA2E;oCAC3E,8CAA8C,IAAI,CAAC,IAAI,EAAE;gCAC3D,QAAQ,EAAE;oCACR,IAAI,EAAE,EAAE,CAAC,QAAQ;oCACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;iCAC7E;6BACF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;oBACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC1B,CAAC,CAAA;gBACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACV,CAAC;SACF;KACF,CAAA;AACH,CAAC","sourcesContent":["// `opaque-state-flow` — errors when a reactive accessor's body flows\n// the state identifier into an expression the walker can't statically\n// trace. The compiler still produces a *correct* binding by forcing\n// FULL_MASK and emitting a whole-state `(s) => s` sentinel into\n// `__prefixes` (see `02 Compiler.md` § \"Opaque-flow classifier\"), but\n// the binding then re-evaluates on every state change rather than\n// only when its actual reads change. This rule surfaces the leak so\n// authors can either:\n//\n//   - Rewrite the accessor as direct property access (`s.foo`,\n//     `s.foo['literal']`), the form the walker can resolve.\n//   - Declare the reads explicitly via `track({ deps: (s) => [...] })`\n//     — the compile-time escape hatch the framework provides for cases\n//     where the read genuinely can't be expressed inline.\n//\n// Detected leak shapes (mirrors the classifier in\n// `transform.ts:computeAccessorMask`):\n//   - `helper(s)` with an Identifier callee that can't be resolved to\n//     a local declaration (function parameter, import, destructured\n//     binding) — the callee may read any field of `s`.\n//\n// NOT flagged (intentional): `obj.helper(s)` / `lib.fn(s)` —\n// PropertyAccessExpression callees. This is the documented headless-\n// components idiom (`pr.valueText(s)` where `pr` comes from\n// `progress.connect()`), and refactoring it defeats the API surface.\n// The runtime sentinel keeps such bindings correct — the cost is a\n// per-update re-evaluation, which is a property of the composition\n// pattern rather than an author mistake worth blocking.\n//   - `new Wrapper(s)` — NewExpression with state as an argument.\n//   - `` tag`${s}` `` — TaggedTemplate with state in a span.\n//   - `{ ...s }` / `[...s]` — spread of state.\n//   - `const x = s` — const aliasing.\n//   - `cond ? s : other` — state in a conditional branch (state\n//     reaches the binding via a path the walker can't trace).\n//   - `s[expr]` — dynamic element access (literal keys are tracked).\n//   - State passed as `arg1+` to any call (the existing delegation\n//     branch only inspects `arg0`).\n\nimport ts from 'typescript'\nimport { rangeFromOffsets } from '../diagnostic.js'\nimport type { CompilerModule } from '../module.js'\nimport { isReactiveAccessor } from '../collect-deps.js'\nimport { resolveAccessorBody } from '../accessor-resolver.js'\n\n// Mirrors the file-local list in collect-deps.ts. Calls to these\n// framework primitives are visited as accessor positions in their\n// own right, so we don't double-classify.\nconst NON_DELEGATION_HELPERS = new Set(['sample', 'item', 'memo', 'text', 'unsafeHtml'])\n\ninterface LeakSite {\n  node: ts.Node\n  shape: string\n  hint: string\n}\n\nfunction findFirstLeakInAccessor(\n  accessor: ts.ArrowFunction | ts.FunctionExpression | ts.FunctionDeclaration,\n): LeakSite | null {\n  if (accessor.parameters.length !== 1) return null\n  const param = accessor.parameters[0]!\n  if (!ts.isIdentifier(param.name)) return null\n  if (!accessor.body) return null\n  const stateParam = param.name.text\n\n  let leak: LeakSite | null = null\n  const visit = (node: ts.Node): void => {\n    if (leak) return\n    if (ts.isIdentifier(node) && node.text === stateParam) {\n      const parent = node.parent\n      if (!parent || ts.isParameter(parent)) {\n        ts.forEachChild(node, visit)\n        return\n      }\n      // Tracked containers — the same set the mask classifier honors.\n      let tracked = false\n      let shape = ''\n      let hint = ''\n      if (ts.isPropertyAccessExpression(parent) && parent.expression === node) {\n        tracked = true\n      } else if (ts.isElementAccessExpression(parent) && parent.expression === node) {\n        if (\n          ts.isStringLiteralLike(parent.argumentExpression) ||\n          ts.isNumericLiteral(parent.argumentExpression)\n        ) {\n          tracked = true\n        } else {\n          shape = `dynamic element access \\`s[<expr>]\\``\n          hint =\n            'replace the dynamic key with a literal property (e.g. `s.foo`), or declare the read via `track({ deps: (s) => [s[key]] })`.'\n        }\n      } else if (ts.isCallExpression(parent) && parent.arguments[0] === node) {\n        if (\n          ts.isIdentifier(parent.expression) &&\n          !NON_DELEGATION_HELPERS.has(parent.expression.text)\n        ) {\n          // Identifier-callee delegation. Recurse into the callee's\n          // body via the same resolver the mask walker uses. If it\n          // resolves to a local accessor, the helper's reads are\n          // walked transitively and the call is tracked. If the\n          // callee is a function parameter, import, destructured\n          // binding, or otherwise unresolvable, this IS the leak\n          // shape — flag it here so the diagnostic points at the\n          // call site rather than at some deeper unresolvable read.\n          const resolved = resolveAccessorBody(parent.expression)\n          if (resolved) {\n            tracked = true\n          } else {\n            shape = `call to an unresolvable callee \\`${parent.expression.text}(s)\\` (function parameter, import, or destructured binding)`\n            hint =\n              'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.'\n          }\n        } else if (!ts.isIdentifier(parent.expression)) {\n          // Method-call / computed callee with state arg —\n          // `obj.helper(s)`, `lib.fn(s)`. This is the documented\n          // headless-components idiom (`pr.valueText(s)` where `pr`\n          // comes from `progress.connect()`); refactoring it would\n          // defeat the API surface. The runtime sentinel keeps the\n          // binding correct — just at the cost of re-evaluating on\n          // every update. Treat as tracked from the lint's POV so\n          // legitimate composition doesn't error the build; the\n          // perf cost is a property of the composition pattern, not\n          // an author mistake worth blocking.\n          tracked = true\n        }\n      } else if (ts.isNewExpression(parent)) {\n        shape = 'state passed as a constructor argument (`new X(s)`)'\n        hint =\n          'compute the derived value inline against direct state reads, or use `track({ deps: (s) => [...] })` to declare the reads.'\n      } else if (ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent)) {\n        shape = 'state spread (`{...s}` / `[...s]`)'\n        hint =\n          'spread only the fields you actually need (`{...s.user}`), or use `track({ deps: (s) => [...] })`.'\n      } else if (ts.isVariableDeclaration(parent)) {\n        shape = 'const alias (`const x = s; … x.foo`)'\n        hint =\n          'inline the alias to `s.foo`, or split the deeper read into a separate single-assignment alias `const foo = s.foo`.'\n      } else if (ts.isConditionalExpression(parent)) {\n        shape = 'state in a conditional branch (`cond ? s : other`)'\n        hint = 'move the conditional inside the property access: `cond ? s.foo : other.foo`.'\n      } else if (ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent)) {\n        shape = 'type assertion wrapping state (`(s as T).foo`)'\n        hint = 'drop the assertion — the chain `s.foo` already carries the type.'\n      } else if (ts.isParenthesizedExpression(parent)) {\n        // Walk up through parens transparently. Don't flag here; the\n        // outer parent classifies.\n        ts.forEachChild(node, visit)\n        return\n      } else {\n        shape = `state used outside a tracked container (${describe(parent)})`\n        hint =\n          'restructure the expression so `s` appears only as the root of a property/element-access chain, or declare the read via `track({ deps: (s) => [...] })`.'\n      }\n      if (!tracked) {\n        leak = { node, shape, hint }\n        return\n      }\n    }\n    ts.forEachChild(node, visit)\n  }\n  visit(accessor.body)\n  return leak\n}\n\nfunction describe(node: ts.Node): string {\n  if (ts.isIdentifier(node)) return node.text\n  if (ts.isPropertyAccessExpression(node)) return `${describe(node.expression)}.${node.name.text}`\n  return ts.SyntaxKind[node.kind]\n}\n\nexport function opaqueStateFlowModule(): CompilerModule {\n  return {\n    name: 'opaque-state-flow',\n    compilerVersion: '^0.3.0',\n    diagnostics: [\n      {\n        id: 'llui/opaque-state-flow',\n        description:\n          \"Reactive accessor flows state into an opaque expression the walker can't trace. The runtime stays correct via a FULL_MASK binding + whole-state sentinel in `__prefixes`, but the binding then re-evaluates on every state change.\",\n      },\n    ],\n    visitors: {\n      [ts.SyntaxKind.SourceFile]: (ctx, node) => {\n        const visited = node as ts.SourceFile\n        const sf = ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true)\n\n        const walk = (n: ts.Node): void => {\n          if ((ts.isArrowFunction(n) || ts.isFunctionExpression(n)) && isReactiveAccessor(n)) {\n            const leak = findFirstLeakInAccessor(n)\n            if (leak) {\n              ctx.reportDiagnostic({\n                id: 'llui/opaque-state-flow',\n                severity: 'error',\n                category: 'perf',\n                message:\n                  `Reactive accessor flows state opaquely — ${leak.shape}. ` +\n                  `The compiler ships a correct binding (FULL_MASK + whole-state sentinel), ` +\n                  `but it re-evaluates on every state change. ${leak.hint}`,\n                location: {\n                  file: sf.fileName,\n                  range: rangeFromOffsets(sf.text, leak.node.getStart(sf), leak.node.getEnd()),\n                },\n              })\n            }\n          }\n          ts.forEachChild(n, walk)\n        }\n        walk(sf)\n      },\n    },\n  }\n}\n"]}
+{"version":3,"file":"opaque-state-flow.js","sourceRoot":"","sources":["../../src/modules/opaque-state-flow.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,+DAA+D;AAC/D,4DAA4D;AAC5D,uEAAuE;AACvE,uEAAuE;AACvE,0DAA0D;AAC1D,EAAE;AACF,kDAAkD;AAClD,uCAAuC;AACvC,sEAAsE;AACtE,oEAAoE;AACpE,uDAAuD;AACvD,EAAE;AACF,6DAA6D;AAC7D,qEAAqE;AACrE,4DAA4D;AAC5D,qEAAqE;AACrE,mEAAmE;AACnE,mEAAmE;AACnE,wDAAwD;AACxD,kEAAkE;AAClE,6DAA6D;AAC7D,+CAA+C;AAC/C,sCAAsC;AACtC,gEAAgE;AAChE,8DAA8D;AAC9D,qEAAqE;AACrE,mEAAmE;AACnE,oCAAoC;AAEpC,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAE7D,iEAAiE;AACjE,kEAAkE;AAClE,0CAA0C;AAC1C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;AAQxF,SAAS,uBAAuB,CAC9B,QAA2E,EAC3E,OAAmC;IAEnC,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAE,CAAA;IACrC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAA;IAElC,IAAI,IAAI,GAAoB,IAAI,CAAA;IAChC,MAAM,KAAK,GAAG,CAAC,IAAa,EAAQ,EAAE;QACpC,IAAI,IAAI;YAAE,OAAM;QAChB,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAA;YAC1B,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;YACD,gEAAgE;YAChE,IAAI,OAAO,GAAG,KAAK,CAAA;YACnB,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,IAAI,GAAG,EAAE,CAAA;YACb,IAAI,EAAE,CAAC,0BAA0B,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxE,OAAO,GAAG,IAAI,CAAA;YAChB,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBAC9E,IACE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,kBAAkB,CAAC;oBACjD,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC9C,CAAC;oBACD,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,sCAAsC,CAAA;oBAC9C,IAAI;wBACF,6HAA6H,CAAA;gBACjI,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAqB,CAAC,CAAA;gBAChE,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;oBACjB,6DAA6D;oBAC7D,wDAAwD;oBACxD,8DAA8D;oBAC9D,wDAAwD;oBACxD,8DAA8D;oBAC9D,yDAAyD;oBACzD,wDAAwD;oBACxD,6DAA6D;oBAC7D,OAAO,GAAG,IAAI,CAAA;gBAChB,CAAC;qBAAM,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;oBAC1B,IACE,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC;wBAClC,CAAC,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EACnD,CAAC;wBACD,0DAA0D;wBAC1D,yDAAyD;wBACzD,uDAAuD;wBACvD,sDAAsD;wBACtD,uDAAuD;wBACvD,uDAAuD;wBACvD,uDAAuD;wBACvD,0DAA0D;wBAC1D,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;wBAChE,IAAI,QAAQ,EAAE,CAAC;4BACb,OAAO,GAAG,IAAI,CAAA;wBAChB,CAAC;6BAAM,CAAC;4BACN,MAAM,YAAY,GAAG,OAAO,EAAE,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;4BACpE,MAAM,eAAe,GAAG,CAAC,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAiB,EAAE,EAAE,CAC/E,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAClB,CAAA;4BACD,KAAK,GAAG,oCAAoC,MAAM,CAAC,UAAU,CAAC,IAAI,6DAA6D,CAAA;4BAC/H,IAAI,eAAe,EAAE,CAAC;gCACpB,IAAI;oCACF,4XAA4X,CAAA;4BAChY,CAAC;iCAAM,CAAC;gCACN,IAAI;oCACF,+KAA+K,CAAA;4BACnL,CAAC;wBACH,CAAC;oBACH,CAAC;yBAAM,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;wBAC/C,iDAAiD;wBACjD,uDAAuD;wBACvD,0DAA0D;wBAC1D,yDAAyD;wBACzD,yDAAyD;wBACzD,yDAAyD;wBACzD,wDAAwD;wBACxD,sDAAsD;wBACtD,0DAA0D;wBAC1D,oCAAoC;wBACpC,OAAO,GAAG,IAAI,CAAA;oBAChB,CAAC;gBACH,CAAC;YACH,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,KAAK,GAAG,qDAAqD,CAAA;gBAC7D,IAAI;oBACF,2HAA2H,CAAA;YAC/H,CAAC;iBAAM,IAAI,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvE,KAAK,GAAG,oCAAoC,CAAA;gBAC5C,IAAI;oBACF,mGAAmG,CAAA;YACvG,CAAC;iBAAM,IAAI,EAAE,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,KAAK,GAAG,sCAAsC,CAAA;gBAC9C,IAAI;oBACF,oHAAoH,CAAA;YACxH,CAAC;iBAAM,IAAI,EAAE,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,KAAK,GAAG,oDAAoD,CAAA;gBAC5D,IAAI,GAAG,8EAA8E,CAAA;YACvF,CAAC;iBAAM,IAAI,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7E,KAAK,GAAG,gDAAgD,CAAA;gBACxD,IAAI,GAAG,kEAAkE,CAAA;YAC3E,CAAC;iBAAM,IAAI,EAAE,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChD,6DAA6D;gBAC7D,2BAA2B;gBAC3B,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC5B,OAAM;YACR,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,2CAA2C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAA;gBACtE,IAAI;oBACF,yJAAyJ,CAAA;YAC7J,CAAC;YACD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;gBAC5B,OAAM;YACR,CAAC;QACH,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IAC9B,CAAC,CAAA;IACD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACpB,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,CAAA;IAC3C,IAAI,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAChG,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE;YACX;gBACE,EAAE,EAAE,wBAAwB;gBAC5B,WAAW,EACT,oOAAoO;aACvO;SACF;QACD,QAAQ,EAAE;YACR,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;gBACxC,gEAAgE;gBAChE,0DAA0D;gBAC1D,gEAAgE;gBAChE,8DAA8D;gBAC9D,0DAA0D;gBAC1D,0DAA0D;gBAC1D,2CAA2C;gBAC3C,MAAM,OAAO,GAAG,IAAqB,CAAA;gBACrC,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBAChE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;gBACrD,MAAM,EAAE,GACN,WAAW;oBACX,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;gBAEnF,MAAM,IAAI,GAAG,CAAC,CAAU,EAAQ,EAAE;oBAChC,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnF,MAAM,IAAI,GAAG,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;wBAChD,IAAI,IAAI,EAAE,CAAC;4BACT,GAAG,CAAC,gBAAgB,CAAC;gCACnB,EAAE,EAAE,wBAAwB;gCAC5B,QAAQ,EAAE,OAAO;gCACjB,QAAQ,EAAE,MAAM;gCAChB,OAAO,EACL,4CAA4C,IAAI,CAAC,KAAK,IAAI;oCAC1D,2EAA2E;oCAC3E,8CAA8C,IAAI,CAAC,IAAI,EAAE;gCAC3D,QAAQ,EAAE;oCACR,IAAI,EAAE,EAAE,CAAC,QAAQ;oCACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;iCAC7E;6BACF,CAAC,CAAA;wBACJ,CAAC;oBACH,CAAC;oBACD,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;gBAC1B,CAAC,CAAA;gBACD,IAAI,CAAC,EAAE,CAAC,CAAA;YACV,CAAC;SACF;KACF,CAAA;AACH,CAAC","sourcesContent":["// `opaque-state-flow` — errors when a reactive accessor's body flows\n// the state identifier into an expression the walker can't statically\n// trace. The compiler still produces a *correct* binding by forcing\n// FULL_MASK and emitting a whole-state `(s) => s` sentinel into\n// `__prefixes` (see `02 Compiler.md` § \"Opaque-flow classifier\"), but\n// the binding then re-evaluates on every state change rather than\n// only when its actual reads change. This rule surfaces the leak so\n// authors can either:\n//\n//   - Rewrite the accessor as direct property access (`s.foo`,\n//     `s.foo['literal']`), the form the walker can resolve.\n//   - Declare the reads explicitly via `track({ deps: (s) => [...] })`\n//     — the compile-time escape hatch the framework provides for cases\n//     where the read genuinely can't be expressed inline.\n//\n// Detected leak shapes (mirrors the classifier in\n// `transform.ts:computeAccessorMask`):\n//   - `helper(s)` with an Identifier callee that can't be resolved to\n//     a local declaration (function parameter, import, destructured\n//     binding) — the callee may read any field of `s`.\n//\n// NOT flagged (intentional): `obj.helper(s)` / `lib.fn(s)` —\n// PropertyAccessExpression callees. This is the documented headless-\n// components idiom (`pr.valueText(s)` where `pr` comes from\n// `progress.connect()`), and refactoring it defeats the API surface.\n// The runtime sentinel keeps such bindings correct — the cost is a\n// per-update re-evaluation, which is a property of the composition\n// pattern rather than an author mistake worth blocking.\n//   - `new Wrapper(s)` — NewExpression with state as an argument.\n//   - `` tag`${s}` `` — TaggedTemplate with state in a span.\n//   - `{ ...s }` / `[...s]` — spread of state.\n//   - `const x = s` — const aliasing.\n//   - `cond ? s : other` — state in a conditional branch (state\n//     reaches the binding via a path the walker can't trace).\n//   - `s[expr]` — dynamic element access (literal keys are tracked).\n//   - State passed as `arg1+` to any call (the existing delegation\n//     branch only inspects `arg0`).\n\nimport ts from 'typescript'\nimport { rangeFromOffsets } from '../diagnostic.js'\nimport type { CompilerModule } from '../module.js'\nimport { isReactiveAccessor } from '../collect-deps.js'\nimport { resolveAccessorBody } from '../accessor-resolver.js'\n\n// Mirrors the file-local list in collect-deps.ts. Calls to these\n// framework primitives are visited as accessor positions in their\n// own right, so we don't double-classify.\nconst NON_DELEGATION_HELPERS = new Set(['sample', 'item', 'memo', 'text', 'unsafeHtml'])\n\ninterface LeakSite {\n  node: ts.Node\n  shape: string\n  hint: string\n}\n\nfunction findFirstLeakInAccessor(\n  accessor: ts.ArrowFunction | ts.FunctionExpression | ts.FunctionDeclaration,\n  checker: ts.TypeChecker | undefined,\n): LeakSite | null {\n  if (accessor.parameters.length !== 1) return null\n  const param = accessor.parameters[0]!\n  if (!ts.isIdentifier(param.name)) return null\n  if (!accessor.body) return null\n  const stateParam = param.name.text\n\n  let leak: LeakSite | null = null\n  const visit = (node: ts.Node): void => {\n    if (leak) return\n    if (ts.isIdentifier(node) && node.text === stateParam) {\n      const parent = node.parent\n      if (!parent || ts.isParameter(parent)) {\n        ts.forEachChild(node, visit)\n        return\n      }\n      // Tracked containers — the same set the mask classifier honors.\n      let tracked = false\n      let shape = ''\n      let hint = ''\n      if (ts.isPropertyAccessExpression(parent) && parent.expression === node) {\n        tracked = true\n      } else if (ts.isElementAccessExpression(parent) && parent.expression === node) {\n        if (\n          ts.isStringLiteralLike(parent.argumentExpression) ||\n          ts.isNumericLiteral(parent.argumentExpression)\n        ) {\n          tracked = true\n        } else {\n          shape = `dynamic element access \\`s[<expr>]\\``\n          hint =\n            'replace the dynamic key with a literal property (e.g. `s.foo`), or declare the read via `track({ deps: (s) => [s[key]] })`.'\n        }\n      } else if (ts.isCallExpression(parent)) {\n        const argIndex = parent.arguments.indexOf(node as ts.Expression)\n        if (argIndex > 0) {\n          // State passed as arg1+ to a call. The header documents this\n          // as NOT flagged (intentional): the existing delegation\n          // branch only attempts to trace arg0, and the mask classifier\n          // emits a whole-state sentinel into `__prefixes` so the\n          // binding stays correct. The cost is per-update re-evaluation\n          // — a property of the composition pattern, not an author\n          // mistake worth blocking. Without this branch we'd fall\n          // through to the default \"outside a tracked container\" leak.\n          tracked = true\n        } else if (argIndex === 0) {\n          if (\n            ts.isIdentifier(parent.expression) &&\n            !NON_DELEGATION_HELPERS.has(parent.expression.text)\n          ) {\n            // Identifier-callee delegation. Recurse into the callee's\n            // body via the same resolver the mask walker uses. If it\n            // resolves to a local accessor, the helper's reads are\n            // walked transitively and the call is tracked. If the\n            // callee is a function parameter, import, destructured\n            // binding, or otherwise unresolvable, this IS the leak\n            // shape — flag it here so the diagnostic points at the\n            // call site rather than at some deeper unresolvable read.\n            const resolved = resolveAccessorBody(parent.expression, checker)\n            if (resolved) {\n              tracked = true\n            } else {\n              const calleeSymbol = checker?.getSymbolAtLocation(parent.expression)\n              const isFunctionParam = !!calleeSymbol?.declarations?.some((d: ts.Declaration) =>\n                ts.isParameter(d),\n              )\n              shape = `call to an unresolvable callee \\`${parent.expression.text}(s)\\` (function parameter, import, or destructured binding)`\n              if (isFunctionParam) {\n                hint =\n                  'this callee is a function parameter — the closure passed at the call site is opaque to per-binding analysis. The framework expects per-row dynamic state to flow through `each` items (slot data on `item.*`) rather than through `(s) => ...` callback parameters; restructure the helper so its bindings read `item.*` and the call site builds the slot data once in `items: (s) => …`.'\n              } else {\n                hint =\n                  'inline the read against `s` directly, refactor the callee into a same-module `const`/`function` declaration, or declare the dependencies via `track({ deps: (s) => [...] })`.'\n              }\n            }\n          } else if (!ts.isIdentifier(parent.expression)) {\n            // Method-call / computed callee with state arg —\n            // `obj.helper(s)`, `lib.fn(s)`. This is the documented\n            // headless-components idiom (`pr.valueText(s)` where `pr`\n            // comes from `progress.connect()`); refactoring it would\n            // defeat the API surface. The runtime sentinel keeps the\n            // binding correct — just at the cost of re-evaluating on\n            // every update. Treat as tracked from the lint's POV so\n            // legitimate composition doesn't error the build; the\n            // perf cost is a property of the composition pattern, not\n            // an author mistake worth blocking.\n            tracked = true\n          }\n        }\n      } else if (ts.isNewExpression(parent)) {\n        shape = 'state passed as a constructor argument (`new X(s)`)'\n        hint =\n          'compute the derived value inline against direct state reads, or use `track({ deps: (s) => [...] })` to declare the reads.'\n      } else if (ts.isSpreadElement(parent) || ts.isSpreadAssignment(parent)) {\n        shape = 'state spread (`{...s}` / `[...s]`)'\n        hint =\n          'spread only the fields you actually need (`{...s.user}`), or use `track({ deps: (s) => [...] })`.'\n      } else if (ts.isVariableDeclaration(parent)) {\n        shape = 'const alias (`const x = s; … x.foo`)'\n        hint =\n          'inline the alias to `s.foo`, or split the deeper read into a separate single-assignment alias `const foo = s.foo`.'\n      } else if (ts.isConditionalExpression(parent)) {\n        shape = 'state in a conditional branch (`cond ? s : other`)'\n        hint = 'move the conditional inside the property access: `cond ? s.foo : other.foo`.'\n      } else if (ts.isAsExpression(parent) || ts.isTypeAssertionExpression(parent)) {\n        shape = 'type assertion wrapping state (`(s as T).foo`)'\n        hint = 'drop the assertion — the chain `s.foo` already carries the type.'\n      } else if (ts.isParenthesizedExpression(parent)) {\n        // Walk up through parens transparently. Don't flag here; the\n        // outer parent classifies.\n        ts.forEachChild(node, visit)\n        return\n      } else {\n        shape = `state used outside a tracked container (${describe(parent)})`\n        hint =\n          'restructure the expression so `s` appears only as the root of a property/element-access chain, or declare the read via `track({ deps: (s) => [...] })`.'\n      }\n      if (!tracked) {\n        leak = { node, shape, hint }\n        return\n      }\n    }\n    ts.forEachChild(node, visit)\n  }\n  visit(accessor.body)\n  return leak\n}\n\nfunction describe(node: ts.Node): string {\n  if (ts.isIdentifier(node)) return node.text\n  if (ts.isPropertyAccessExpression(node)) return `${describe(node.expression)}.${node.name.text}`\n  return ts.SyntaxKind[node.kind]\n}\n\nexport function opaqueStateFlowModule(): CompilerModule {\n  return {\n    name: 'opaque-state-flow',\n    compilerVersion: '^0.3.0',\n    diagnostics: [\n      {\n        id: 'llui/opaque-state-flow',\n        description:\n          \"Reactive accessor flows state into an opaque expression the walker can't trace. The runtime stays correct via a FULL_MASK binding + whole-state sentinel in `__prefixes`, but the binding then re-evaluates on every state change.\",\n      },\n    ],\n    visitors: {\n      [ts.SyntaxKind.SourceFile]: (ctx, node) => {\n        // When the host adapter has built a Program, walk the checker's\n        // own SourceFile so symbol resolution (Alias → Symbol via\n        // `getSymbolAtLocation`) actually works. The reparsed file used\n        // in the AST-only fallback is not part of any Program, so the\n        // checker can't resolve identifiers in it. Fall back to a\n        // reparse for paths without a Program (test harness, lint\n        // adapters without cross-file resolution).\n        const visited = node as ts.SourceFile\n        const fromProgram = ctx.program?.getSourceFile(visited.fileName)\n        const checker = fromProgram ? ctx.checker : undefined\n        const sf =\n          fromProgram ??\n          ts.createSourceFile(visited.fileName, visited.text, ts.ScriptTarget.Latest, true)\n\n        const walk = (n: ts.Node): void => {\n          if ((ts.isArrowFunction(n) || ts.isFunctionExpression(n)) && isReactiveAccessor(n)) {\n            const leak = findFirstLeakInAccessor(n, checker)\n            if (leak) {\n              ctx.reportDiagnostic({\n                id: 'llui/opaque-state-flow',\n                severity: 'error',\n                category: 'perf',\n                message:\n                  `Reactive accessor flows state opaquely — ${leak.shape}. ` +\n                  `The compiler ships a correct binding (FULL_MASK + whole-state sentinel), ` +\n                  `but it re-evaluates on every state change. ${leak.hint}`,\n                location: {\n                  file: sf.fileName,\n                  range: rangeFromOffsets(sf.text, leak.node.getStart(sf), leak.node.getEnd()),\n                },\n              })\n            }\n          }\n          ts.forEachChild(n, walk)\n        }\n        walk(sf)\n      },\n    },\n  }\n}\n"]}

package/dist/transform.d.ts

@@ -56,7 +56,7 @@ export interface PreExtractedSchemas {
     stateSchema?: ReturnType<typeof extractStateSchema>;
     effectSchema?: ReturnType<typeof extractEffectSchema>;
 }
-export declare function transformLlui(source: string, _filename: string, devMode?: boolean, emitAgentMetadata?: boolean, mcpPort?: number | null, verbose?: boolean, typeSources?: ExternalTypeSources, preExtracted?: PreExtractedSchemas, crossFilePaths?: ReadonlySet<string>, crossFileOpaque?: boolean): {
+export declare function transformLlui(source: string, _filename: string, devMode?: boolean, emitAgentMetadata?: boolean, mcpPort?: number | null, verbose?: boolean, typeSources?: ExternalTypeSources, preExtracted?: PreExtractedSchemas, crossFilePaths?: ReadonlySet<string>, crossFileOpaque?: boolean, crossFileProgram?: ts.Program): {
     output: string;
     edits: TransformEdit[];
     diagnostics: Diagnostic[];

package/dist/transform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../src/transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAiCjD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAQhF;AAwED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAC/C,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IACzD,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;CACtD;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,EACf,iBAAiB,UAAQ,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,OAAO,UAAQ,EACf,WAAW,CAAC,EAAE,mBAAmB,EACjC,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,UAAQ,GACtB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,IAAI,CAkxB9E;AA2cD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,UAAU,EAAE,EAAE,CAAC,iBAAiB,GAC/B,OAAO,CAUT;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,EAAE,CAAC,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAgBT;AAgLD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,mBAAmB,EAC3E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAa,EACjC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAiLvD;AAkBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAcrF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CASzF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CAYR"}
+{"version":3,"file":"transform.d.ts","sourceRoot":"","sources":["../src/transform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAA;AAG3B,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAOtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAiCjD,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,CAAC,UAAU,CAQhF;AAwED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,GAAG,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1C,MAAM,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAC9C;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;IAC/C,cAAc,CAAC,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;IACzD,WAAW,CAAC,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;IACnD,YAAY,CAAC,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAA;CACtD;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,UAAQ,EACf,iBAAiB,UAAQ,EACzB,OAAO,GAAE,MAAM,GAAG,IAAW,EAC7B,OAAO,UAAQ,EACf,WAAW,CAAC,EAAE,mBAAmB,EACjC,YAAY,CAAC,EAAE,mBAAmB,EAClC,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,eAAe,UAAQ,EACvB,gBAAgB,CAAC,EAAE,EAAE,CAAC,OAAO,GAC5B;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,aAAa,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GAAG,IAAI,CA0xB9E;AA2cD,wBAAgB,eAAe,CAC7B,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,UAAU,EAAE,EAAE,CAAC,iBAAiB,GAC/B,OAAO,CAUT;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,EAAE,CAAC,UAAU,EACnB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC5B,OAAO,CAgBT;AAgLD,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,EAAE,CAAC,aAAa,GAAG,EAAE,CAAC,kBAAkB,GAAG,EAAE,CAAC,mBAAmB,EAC3E,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAa,EACjC,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAiLvD;AAkBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3D;AAED;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,GAAG,MAAM,GAAG,IAAI,CAcrF;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CASzF;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAAC,GAChE,MAAM,CAYR"}

package/dist/transform.js

@@ -104,7 +104,7 @@ const ELEMENT_HELPERS = new Set([
     'ul',
     'video',
 ]);
-export function transformLlui(source, _filename, devMode = false, emitAgentMetadata = false, mcpPort = 5200, verbose = false, typeSources, preExtracted, crossFilePaths, crossFileOpaque = false) {
+export function transformLlui(source, _filename, devMode = false, emitAgentMetadata = false, mcpPort = 5200, verbose = false, typeSources, preExtracted, crossFilePaths, crossFileOpaque = false, crossFileProgram) {
     // Use the caller-provided filename so any module reading `sf.fileName`
     // (e.g. `componentMetaModule` emitting `__componentMeta: { file }`)
     // sees the real path instead of a placeholder. The monolith's inline
@@ -391,7 +391,15 @@ export function transformLlui(source, _filename, devMode = false, emitAgentMetad
     // `typeSources` flows through to lint modules that need cross-file
     // visibility (e.g. agent-emits-drift's imported-Msg case). Same
     // shape as `ModuleExternalTypes`.
-    const registryResult = registry.run(sourceFile, undefined, typeSources);
+    // Cross-file Program (when the host adapter supplied one) flows through
+    // to lint modules that need to resolve identifiers across files — e.g.
+    // opaque-state-flow walking through an imported helper to decide
+    // whether `helper(s)` is a tracked delegation or an opaque leak. The
+    // checker derived here is the one bound to that Program; identifiers
+    // in `crossFileProgram.getSourceFile(_filename)` resolve through it,
+    // identifiers in the locally-reparsed `sourceFile` do not.
+    const crossFileChecker = crossFileProgram?.getTypeChecker();
+    const registryResult = registry.run(sourceFile, crossFileChecker, typeSources, crossFileProgram);
     // The registry phases (preTransform v2c/decomp-7, transformCall
     // v2c/decomp-11/12) may have mutated the source file — replace our
     // local reference so all subsequent code (fieldBits, visitor,