candor-ts 0.40.0 → 0.40.2

package/README.md

@@ -185,6 +185,20 @@ functions analyzed): its DI-style fs injection means many functions read `Unknow
 that's the contract working, not noise. The report says "can reach", never "does"; an absent
 literal is never a claim of absence.
 
+**Framework dependency injection (spec §2's bounded-CHA clause).** rimraf's injection is a function-valued
+parameter, which reads `Unknown`. A DI *container* is measured separately, on NestJS 10 with an executed fixture:
+
+- a provider entry `{ provide: Store, useClass | useValue | useFactory | useExisting: … }` whose token is a project
+  CLASS is read as a conversion: the substitute joins `Store`'s candidates, so `this.store.save()` is charged the
+  union of `Store.save` and the substitute's `save` (SOUNDNESS R1061 — silent before, all three forms executed);
+- a parameter typed by an INTERFACE (`@Inject("SINK") sink: Sink`) dispatches over the project's visible
+  implementors of `Sink`, so a `useClass` that `implements Sink` is charged; a `useValue` object literal that
+  implements nothing reads `Unknown` (`dispatch:`).
+
+**Named miss:** a provider list the scan cannot see (built at runtime, or imported from an unscanned package), a
+token that is a variable rather than the class itself, and a substitute supplied by a dependency are not
+substitutions to this engine. Gate a DI-heavy service with `deny <E> Unknown` as well as `deny <E>`.
+
 ## Cross-engine consistency — machine-checked
 
 candor-ts is one of the **four code engines** (with the reference engine candor-java, the Rust

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "candor-ts",
-  "version": "0.40.0",
+  "version": "0.40.2",
   "mcpName": "io.github.tombaldwin/candor",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.40)",
   "type": "module",
   "dependencies": {
-    "@types/node": "^25.9.2",
-    "typescript": "^6.0.3"
+    "@types/node": "25.9.2",
+    "typescript": "6.0.3"
   },
   "bin": {
     "candor-ts": "./scan.mjs",
@@ -21,6 +21,8 @@
   },
   "scripts": {
     "lint": "eslint *.mjs",
+    "prepack": "node -e \"require('fs').copyFileSync('package-lock.json','npm-shrinkwrap.json')\"",
+    "postpack": "node -e \"require('fs').rmSync('npm-shrinkwrap.json',{force:true})\"",
     "test": "npm run lint && node --test test-unit.mjs && node test.mjs --parallel && node test-mcp.mjs && node test-lsp.mjs && node test-watch.mjs && npm run test:probe && npm run test:fuzz",
     "test:unit": "node --test test-unit.mjs",
     "test:probe": "node fabrication_probe.mjs",
@@ -45,6 +47,7 @@
     "node": ">=20"
   },
   "files": [
+    "npm-shrinkwrap.json",
     "Cases.ts",
     "scan.mjs",
     "query.mjs",

package/policy.mjs

@@ -1296,11 +1296,19 @@ export function evaluatePolicy(pol, functions, callgraph, incomplete = new Map()
   // a rule whose destinations all resolve while its `from` names nothing has bound nothing, and that is
   // exactly the typo that leaves an operator believing a leaf is protected.
   for (const r of pol.only ?? []) zeroCount.set(r.raw, 0);
+  // ⟨SOUNDNESS R952⟩ …and a SCOPED `allow`. It was never enrolled, so `allow Net in nosuch.fn ok.example` — a
+  // typo'd scope — bound nothing, said nothing, and exited 0: a gate that cannot fail, exactly the `deny` typo
+  // this pass exists for, one rule kind over. A scoped allow makes a promise about the functions its scope names;
+  // naming none is the same unanswerable rule. A SCOPELESS allow applies to every function and stays exempt, as a
+  // scopeless `deny` does. Disclosure only: the line and `zeroMatch` entry `deny` already gets, exit unchanged
+  // (candor-rust's half, same shape).
+  for (const r of pol.allow ?? []) if (r.scope) zeroCount.set(r.raw, 0);
   if (zeroCount.size) {
     const names = new Set(functions.map((f) => f.fn));
     for (const k of Object.keys(callgraph ?? {})) names.add(k);
     for (const n of names) {
       for (const r of pol.deny) if (r.scope && scopeMatches(n, r.scope)) zeroCount.set(r.raw, zeroCount.get(r.raw) + 1);
+      for (const r of pol.allow ?? []) if (r.scope && scopeMatches(n, r.scope)) zeroCount.set(r.raw, zeroCount.get(r.raw) + 1);
       for (const r of pol.forbid) {
         if (scopeMatches(n, r.from) || scopeMatches(n, r.to)) zeroCount.set(r.raw, zeroCount.get(r.raw) + 1);
       }