candor-ts 0.40.1 → 0.40.3

package/README.md

@@ -185,6 +185,26 @@ functions analyzed): its DI-style fs injection means many functions read `Unknow
 that's the contract working, not noise. The report says "can reach", never "does"; an absent
 literal is never a claim of absence.
 
+**Framework dependency injection (spec §2's bounded-CHA clause).** rimraf's injection is a function-valued
+parameter, which reads `Unknown`. A DI *container* is measured separately, on NestJS 10 with an executed fixture:
+
+- a provider entry `{ provide: Store, useClass | useValue | useFactory | useExisting: … }` whose token is a project
+  CLASS is read as a conversion: the substitute joins `Store`'s candidates, so `this.store.save()` is charged the
+  union of `Store.save` and the substitute's `save` (SOUNDNESS R1061 — silent before, all three forms executed);
+- a parameter typed by an INTERFACE (`@Inject("SINK") sink: Sink`) dispatches over the project's visible
+  implementors of `Sink`, so a `useClass` that `implements Sink` is charged; a `useValue` object literal that
+  implements nothing reads `Unknown` (`dispatch:`).
+
+- the TOKEN is read through the checker's type, so `const TOK = Store`, an imported token, `TOKENS.store` and a
+  `.map` over `[Store]` name `Store`; a helper's `token`/`impl` parameter is read through its visible call sites; a
+  token typed `Function`/`Type<any>` joins its substitute to every project class it is assignable to (R1061);
+- a substitute the scan cannot name (`useClass: impls[i]` typed `Type<Store>`, a `useValue` typed `any`) makes a
+  dispatch on the token class read `Unknown` (`dispatch:`).
+
+**Named miss:** a provider list the scan cannot see at all (one imported from an unscanned package) and a substitute
+supplied by a dependency for a token the dependency owns. Gate a DI-heavy service with `deny <E> Unknown` as well as
+`deny <E>`.
+
 ## Cross-engine consistency — machine-checked
 
 candor-ts is one of the **four code engines** (with the reference engine candor-java, the Rust

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "candor-ts",
-  "version": "0.40.1",
+  "version": "0.40.3",
   "mcpName": "io.github.tombaldwin/candor",
   "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.40)",
   "type": "module",
   "dependencies": {
-    "@types/node": "^25.9.2",
-    "typescript": "^6.0.3"
+    "@types/node": "25.9.2",
+    "typescript": "6.0.3"
   },
   "bin": {
     "candor-ts": "./scan.mjs",
@@ -21,6 +21,8 @@
   },
   "scripts": {
     "lint": "eslint *.mjs",
+    "prepack": "node -e \"require('fs').copyFileSync('package-lock.json','npm-shrinkwrap.json')\"",
+    "postpack": "node -e \"require('fs').rmSync('npm-shrinkwrap.json',{force:true})\"",
     "test": "npm run lint && node --test test-unit.mjs && node test.mjs --parallel && node test-mcp.mjs && node test-lsp.mjs && node test-watch.mjs && npm run test:probe && npm run test:fuzz",
     "test:unit": "node --test test-unit.mjs",
     "test:probe": "node fabrication_probe.mjs",
@@ -45,6 +47,7 @@
     "node": ">=20"
   },
   "files": [
+    "npm-shrinkwrap.json",
     "Cases.ts",
     "scan.mjs",
     "query.mjs",