carrick 0.3.104 → 0.3.106

package/sidecar/dist/src/capture/check-fields.js

@@ -29,6 +29,7 @@
  * Seam: node builtins + `typescript` + this bundle only.
  */
 import ts from 'typescript';
+import { memberPath } from './member-name.js';
 /**
  * Cap on named fields. A mismatch with more differing members than this is
  * better described as two unrelated shapes than as a list, and the text says
@@ -172,7 +173,7 @@ function walk(sent, expected, path, depth, ctx) {
      * makes a sender-only member worth naming beside it. */
     let absent = 0;
     for (const [name, expectedProp] of expectedProps) {
-        const at = join(path, name);
+        const at = memberPath(path, expectedProp, checker);
         const sentProp = sentProps.get(name);
         const supplied = ctx.serverSupplied.has(name);
         if (!sentProp) {
@@ -226,15 +227,12 @@ function walk(sent, expected, path, depth, ctx) {
     // producer returns — nothing is absent and nothing is named.
     if (absent === 0)
         return;
-    for (const [name] of sentProps) {
+    for (const [name, sentProp] of sentProps) {
         if (expectedProps.has(name))
             continue;
-        ctx.found.push({ path: join(path, name), nature: 'extra_in_sent' });
+        ctx.found.push({ path: memberPath(path, sentProp, checker), nature: 'extra_in_sent' });
     }
 }
-function join(path, name) {
-    return path === '' ? name : `${path}.${name}`;
-}
 function isOptional(symbol) {
     return (symbol.flags & ts.SymbolFlags.Optional) !== 0;
 }

package/sidecar/dist/src/capture/check-probe.js

@@ -155,8 +155,8 @@ export function buildProbe(spec, packageOf) {
     // them in, so a route sending a `Uint8Array` read with `.blob()` is not a
     // mismatch, and neither is the same route read as text. Either side, either
     // half: a file upload states no fields a declared body could be compared
-    // with. The classifier lets this gate override a mismatch only, so bytes
-    // that assign to bytes still read compatible. `null`/`undefined` are
+    // with. Bytes that assign to bytes are not a contract either: the check
+    // cannot read a file's content (carrick#1812). `null`/`undefined` are
     // dropped first, so `Blob | null` still gates, while a bare `null`,
     // `undefined` or `never` leaves nothing to test.
     if (spec.protocol === 'http') {
@@ -182,6 +182,12 @@ export function buildProbe(spec, packageOf) {
         //     or several (ambiguous envelope, or a bare payload whose own fields
         //     include more than one object-shaped property) keep the whole type —
         //     the unwrap never fires on anything but an unambiguous envelope;
+        //   - a consumer that names a field only the outer object has (not the
+        //     payload under its one object-shaped property) reads that object, so
+        //     it keeps the whole type (carrick#1764): a bare payload with one
+        //     object-shaped property is not an envelope around it. A field both
+        //     declare says nothing either way, and neither does `__typename`, which
+        //     the server puts on every object (see below);
         //   - `GqlObjLike` can never select `any`/`unknown`/`never` (top/bottom
         //     types fail both its array and its object arm), and the comparand is
         //     re-gated below anyway — the v2 port of v1's comparand re-guard, so
@@ -191,6 +197,10 @@ export function buildProbe(spec, packageOf) {
         push(`type GqlPayloadKeys<T> = { [K in keyof T]-?: [GqlObjLike<T[K]>] extends [true] ? K : never }[keyof T];`);
         push(`type GqlSingleKey<K> = [K] extends [never] ? never : ([GqlIsUnion<K>] extends [false] ? K : never);`);
         push(`type GqlPayloadOf<S> = [S] extends [readonly unknown[]] ? never : [GqlIsUnion<S>] extends [true] ? never : [S] extends [object] ? ([GqlSingleKey<GqlPayloadKeys<S>>] extends [never] ? never : S[GqlSingleKey<GqlPayloadKeys<S>> & keyof S]) : never;`);
+        // The field names a reading declares: the keys of every object member, so
+        // a nullable or union consumer names what each member names.
+        push(`type GqlNames<T> = T extends object ? keyof T : never;`);
+        push(`type GqlReadsOuter<S, E> = [Extract<Exclude<GqlNames<S>, GqlNames<GqlPayloadOf<S>>>, Exclude<GqlNames<E>, '__typename'>>] extends [never] ? false : true;`);
         // carrick#1759: the server supplies `__typename` on every object a
         // selection asks for, so the consumer's `__typename` is read as OPTIONAL,
         // at any depth. It keeps its declared type: a producer that states a
@@ -208,14 +218,14 @@ export function buildProbe(spec, packageOf) {
         //     nothing observable, so a consumer with no `__typename` to relax is
         //     judged, and named in the headline, exactly as before.
         //
-        // The envelope short-circuit below tests the RELAXED consumer: a bare
-        // payload with one object-shaped property would otherwise fail it on
-        // `__typename` alone and unwrap onto that property.
+        // The envelope short-circuit below tests the RELAXED consumer: a consumer
+        // that names only fields the payload shares would otherwise fail it on
+        // `__typename` alone and unwrap onto that payload.
         push(`type GqlDepth = [never, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15];`);
         push(`type GqlTypenameParts<T, D extends number> = { [K in keyof T as K extends '__typename' ? never : K]: GqlTypenameOptional<T[K], GqlDepth[D]> } & { [K in keyof T as K extends '__typename' ? K : never]?: T[K] };`);
         push(`type GqlTypenameOptional<T, D extends number = 16> = [D] extends [never] ? T : T extends (...args: any[]) => any ? T : T extends object ? ('__typename' extends keyof T ? { [K in keyof GqlTypenameParts<T, D>]: GqlTypenameParts<T, D>[K] } : { [K in keyof T]: GqlTypenameOptional<T[K], GqlDepth[D]> }) : T;`);
         push(`type GqlExpected = [GqlTypenameOptional<Expected>] extends [Expected] ? Expected : GqlTypenameOptional<Expected>;`);
-        push(`type GqlComparand = [Sent] extends [GqlExpected] ? Sent : ([GqlPayloadOf<Sent>] extends [never] ? Sent : GqlPayloadOf<Sent>);`);
+        push(`type GqlComparand = [Sent] extends [GqlExpected] ? Sent : ([GqlPayloadOf<Sent>] extends [never] ? Sent : [GqlReadsOuter<Sent, Expected>] extends [true] ? Sent : GqlPayloadOf<Sent>);`);
         gateLines.set(push(`type _G_comparand_any = Assert<Not<IsAny<GqlComparand>>>;`), 'sent:any');
         gateLines.set(push(`type _G_comparand_unknown = Assert<Not<IsUnknown<GqlComparand>>>;`), 'sent:unknown');
         gateLines.set(push(`type _G_comparand_never = Assert<Not<IsNever<GqlComparand>>>;`), 'sent:never');

package/sidecar/dist/src/capture/check-scrub.d.ts

@@ -16,6 +16,9 @@
 export interface ScrubContext {
     /** Absolute path of the scratch workspace root (fully removed from output). */
     workspaceRoot: string;
+    /** The same root with symlinks resolved, as a tool that prints real paths
+     * names it (pnpm, under a macOS temp dir). Absent when there is no tree. */
+    workspaceRealRoot?: string;
     /** Workspace package dir (== sanitized service) -> the @carrick/<dir> label. */
     packageLabelOf: (packageDir: string) => string | undefined;
 }

package/sidecar/dist/src/capture/check-scrub.js

@@ -46,10 +46,14 @@ export function scrubPaths(text, ctx) {
     let out = text.replace(IMPORT_PATH_RE, (_m, p1) => {
         return `import("${labelForImportPath(p1, ctx)}")`;
     });
-    // Defensive: no raw temp path may survive anywhere in the message.
-    if (ctx.workspaceRoot) {
-        out = out.split(ctx.workspaceRoot).join('');
-        out = out.split(ctx.workspaceRoot.split('/').join('\\')).join('');
+    // Defensive: no raw temp path may survive anywhere in the message. The real
+    // root goes first: the given root can be its suffix (`/private/var/...`
+    // against `/var/...`), and stripping that first would strand the prefix.
+    for (const root of [ctx.workspaceRealRoot, ctx.workspaceRoot]) {
+        if (!root)
+            continue;
+        out = out.split(root).join('');
+        out = out.split(root.split('/').join('\\')).join('');
     }
     return out;
 }

package/sidecar/dist/src/capture/check.js

@@ -103,15 +103,18 @@ export async function runCheck(opts, onProgress) {
     // to a flat npm install that manufactures nominal false-incompatibles. Fail
     // explicitly instead (design Check step 2).
     if (!fs.existsSync(pnpmPath)) {
-        const planned = planPairs(opts, (s) => `@carrick/${s}`);
+        // Capture-decay verdicts stand without isolation too (carrick#1833).
+        const { preGated, probing } = preGate(planPairs(opts, (s) => `@carrick/${s}`), readStubAliasRecords(opts.stubs));
         return {
             success: false,
             workspace_dir: '',
             isolation: 'unavailable',
             install_ok: false,
-            install_error: 'vendored pnpm not found; type isolation is unavailable',
             ts_version: tsVersion,
-            verdicts: sortVerdicts(unverifiableAll(planned, 'isolation:unavailable', 'type isolation unavailable (pnpm missing); compatibility cannot be verified.')),
+            verdicts: sortVerdicts([
+                ...unverifiableAll(probing, 'isolation:unavailable', 'type isolation unavailable (pnpm missing); compatibility cannot be verified.'),
+                ...preGated,
+            ]),
             degraded_services: opts.stubs.map((s) => ({
                 service_name: s.service_name,
                 reason: 'isolation unavailable',
@@ -126,6 +129,7 @@ export async function runCheck(opts, onProgress) {
     });
     const scrubCtx = {
         workspaceRoot: ws.workspaceDir,
+        workspaceRealRoot: fs.realpathSync(ws.workspaceDir),
         packageLabelOf: ws.packageLabelOf,
     };
     // Generate probes. A pair naming a service with no stub is unverifiable.
@@ -154,61 +158,26 @@ export async function runCheck(opts, onProgress) {
         const spec = opts.pairs.find((p) => p.pair_key === v.pair_key);
         v.pair_id = fnvOfSpec(spec);
     }
-    // Capture-time deep-decay pre-gate (adversarial-review finding 1): a
-    // member-level `any`/`unknown` recorded by the capture self-check with no
-    // failing-external explanation. The probe gates below are WHOLE-type only
-    // — `{ orderId: string; metadata: any }` sails through IsAny and the
-    // assignment compiles clean — so such pairs must never reach a probe.
-    // `any` routes to gate_caught_baked_any, `unknown` to unverifiable; both
-    // read as None downstream, never compatible.
     const aliasRecords = readStubAliasRecords(opts.stubs);
-    const preGated = [];
-    const probing = [];
-    for (const plan of plans) {
-        const hit = deepDecayOf(plan, aliasRecords);
-        if (!hit) {
-            probing.push(plan);
-            continue;
-        }
-        preGated.push({
-            pair_id: plan.pairId,
-            pair_key: plan.spec.pair_key,
-            // `any` is a confirmed baked top type -> gate_caught_baked_any; `unknown`
-            // and `budget_exhausted` (a subtree the capture walk could not finish)
-            // are "cannot verify" -> unverifiable. All read as None downstream.
-            bucket: hit.kind === 'any' ? 'gate_caught_baked_any' : 'unverifiable',
-            gate: `capture:${hit.side}:${hit.kind}`,
-            diagnostic: hit.kind === 'budget_exhausted'
-                ? `the ${hit.side} type is too deep or wide to verify within the ` +
-                    `capture budget (at '${hit.path}'); compatibility cannot be ` +
-                    `verified — abstaining so a buried 'any' can never read compatible.`
-                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}' from ` +
-                    `capture; compatibility cannot be verified (a partially-unresolved ` +
-                    `type would let an arbitrary shape read compatible).`,
-            codes: [],
-            resolved: false,
-            unresolved_side: hit.side,
-            unresolved_reason: hit.kind === 'budget_exhausted'
-                ? `the ${hit.side} type is too deep or wide to verify at '${hit.path}'`
-                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}'`,
-            notes: [],
-        });
-    }
+    const { preGated, probing } = preGate(plans, aliasRecords);
     writeProbes(ws, probing);
     const errors = [];
     const degraded = [];
     // ---- Install (async, off the event loop) --------------------------------
     progress('installing', 'installing pinned dependencies');
     const install = await runProcess(pnpmPath, ['install'], ws.workspaceDir);
-    const installOk = install.code === 0;
-    let installError;
-    if (!installOk) {
-        installError = scrubPaths((install.stderr || install.stdout).trim().slice(0, 2000), scrubCtx);
+    if (install.code !== 0) {
+        const installError = scrubPaths((install.stderr || install.stdout).trim().slice(0, 2000), scrubCtx);
+        // `errors` says why the run failed (carrick#1821); each pair the install
+        // stopped says it too, because the client reads every pair's own verdict
+        // on a failed check (carrick#1833).
+        errors.push(`workspace dependency install failed${installError ? `: ${installError}` : ''}`);
         for (const s of opts.stubs) {
             degraded.push({ service_name: s.service_name, reason: 'workspace install failed' });
         }
         const verdicts = sortVerdicts([
-            ...unverifiableAll(probing, 'install:failed', 'workspace dependency install failed; compatibility cannot be verified.'),
+            ...unverifiableAll(probing, 'install:failed', 'workspace dependency install failed; compatibility cannot be verified.' +
+                (installError ? ` Installer output: ${installError}` : '')),
             // Capture-decay verdicts stand regardless of the install outcome.
             ...preGated,
             ...unresolved,
@@ -220,7 +189,6 @@ export async function runCheck(opts, onProgress) {
             workspace_dir: cleanup ? '' : ws.workspaceDir,
             isolation: 'pnpm',
             install_ok: false,
-            install_error: installError,
             ts_version: tsVersion,
             verdicts,
             degraded_services: degraded,
@@ -249,7 +217,9 @@ export async function runCheck(opts, onProgress) {
             });
         }
         const verdicts = sortVerdicts([
-            ...unverifiableAll(probing, 'tsc:abnormal-termination', 'the type checker terminated abnormally; compatibility cannot be verified.'),
+            ...unverifiableAll(probing, 'tsc:abnormal-termination', `the type checker terminated abnormally (exit code ${tsc.code ?? 'null'}); ` +
+                'compatibility cannot be verified.' +
+                (excerpt ? ` Compiler output: ${excerpt}` : '')),
             ...preGated,
             ...unresolved,
         ]);
@@ -300,6 +270,7 @@ export async function runCheck(opts, onProgress) {
             scrubCtx,
             deepFindings: deepByPair.get(plan.pairId),
             fieldReport: fieldsByPair.get(plan.pairId),
+            rawTextSide: rawTextSideOf(plan, aliasRecords),
         })),
         ...preGated,
         ...unresolved,
@@ -341,6 +312,61 @@ function readStubAliasRecords(stubs) {
     }
     return byService;
 }
+/**
+ * Capture-time deep-decay pre-gate (adversarial-review finding 1): a
+ * member-level `any`/`unknown` recorded by the capture self-check with no
+ * failing-external explanation. The probe gates are WHOLE-type only —
+ * `{ orderId: string; metadata: any }` sails through IsAny and the assignment
+ * compiles clean — so such pairs must never reach a probe. `any` routes to
+ * gate_caught_baked_any, `unknown` to unverifiable; both read as None
+ * downstream, never compatible. These verdicts come from the capture alone,
+ * so they stand whatever the install or the compiler then does (carrick#1833).
+ */
+function preGate(plans, aliasRecords) {
+    const preGated = [];
+    const probing = [];
+    for (const plan of plans) {
+        const hit = deepDecayOf(plan, aliasRecords);
+        if (!hit) {
+            probing.push(plan);
+            continue;
+        }
+        preGated.push({
+            pair_id: plan.pairId,
+            pair_key: plan.spec.pair_key,
+            // `any` is a confirmed baked top type -> gate_caught_baked_any; `unknown`
+            // and `budget_exhausted` (a subtree the capture walk could not finish)
+            // are "cannot verify" -> unverifiable. All read as None downstream.
+            bucket: hit.kind === 'any' ? 'gate_caught_baked_any' : 'unverifiable',
+            gate: `capture:${hit.side}:${hit.kind}`,
+            diagnostic: hit.kind === 'budget_exhausted'
+                ? `the ${hit.side} type is too deep or wide to verify within the ` +
+                    `capture budget (at '${hit.path}'); compatibility cannot be ` +
+                    `verified — abstaining so a buried 'any' can never read compatible.`
+                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}' from ` +
+                    `capture; compatibility cannot be verified (a partially-unresolved ` +
+                    `type would let an arbitrary shape read compatible).`,
+            codes: [],
+            resolved: false,
+            unresolved_side: hit.side,
+            unresolved_reason: hit.kind === 'budget_exhausted'
+                ? `the ${hit.side} type is too deep or wide to verify at '${hit.path}'`
+                : `the ${hit.side} type carries '${hit.kind}' at '${hit.path}'`,
+            notes: [],
+        });
+    }
+    return { preGated, probing };
+}
+/**
+ * The side whose capture record marks its body as read raw (carrick#1842):
+ * the sent side when both are, as the bytes gate names it.
+ */
+function rawTextSideOf(plan, aliasRecords) {
+    return [plan.direction.sent, plan.direction.expected].find((side) => {
+        const endpoint = plan.spec[side];
+        return aliasRecords.get(endpoint.service_name)?.get(endpoint.alias)?.raw_text_read === true;
+    });
+}
 /** First side (producer, then consumer) whose capture recorded a deep decay. */
 function deepDecayOf(plan, aliasRecords) {
     for (const side of ['producer', 'consumer']) {

package/sidecar/dist/src/capture/deep-walk.d.ts

@@ -63,6 +63,9 @@ export declare function findDisqualifyingTopTypes(root: ts.Type, program: ts.Pro
  * names. A walk that runs out of budget reports what it found before it did.
  */
 export declare function findUnresolvedPlaceholders(root: ts.Type, program: ts.Program, checker: ts.TypeChecker, location: ts.Node): string[];
+/** TypeScript's unresolved-reference placeholder: `TypeFlags.Any` with the
+ * internal `intrinsicName === 'error'` (stable since TS 1.x; see `anchors.ts`). */
+export declare function isErrorPlaceholder(t: ts.Type): boolean;
 /** What an anchor's SOURCE program could not resolve (carrick#1164). */
 export interface UnresolvedAtAnchor {
     /** Member paths holding the unresolved-reference placeholder. */
@@ -87,3 +90,20 @@ export interface UnresolvedAtAnchor {
  * one other cause the walk itself can distinguish is its own budget.
  */
 export declare function provenanceOf(finding: DeepTopType, unresolved?: UnresolvedAtAnchor): TypeProvenance;
+/**
+ * The entry for one position at which the emitted tree holds the
+ * unresolved-reference placeholder (carrick#1446): `path` is `''` for the
+ * alias's own type. `names` are the identifiers the self-check could not find
+ * in this alias's statement and the files it reaches.
+ *
+ * The cause is `unresolved_import`, the word a reader already has for "a
+ * reference here did not resolve"; the detail says where it failed to.
+ */
+export declare function unresolvedInTreeProvenance(path: string, names: readonly string[]): TypeProvenance;
+/**
+ * The root entry for a literal anchor demoted because its text names a module
+ * whose declaration emit was skipped (carrick#1446, carrick#1165): that text is
+ * what the index serves for it, and nothing in the emitted tree declares what
+ * it imports.
+ */
+export declare function unemittedModuleProvenance(): TypeProvenance;

package/sidecar/dist/src/capture/deep-walk.js

@@ -14,6 +14,7 @@
  * wherever it is reported.
  */
 import ts from 'typescript';
+import { memberPath } from './member-name.js';
 /** Cap on findings reported per alias. The FIRST one is what the check phase
  * pre-gates on, so verdicts never depend on this number; the rest are there to
  * tell a reader which fields are `any` (carrick#376), and a type with more
@@ -73,7 +74,7 @@ export function findUnresolvedPlaceholders(root, program, checker, location) {
 }
 /** TypeScript's unresolved-reference placeholder: `TypeFlags.Any` with the
  * internal `intrinsicName === 'error'` (stable since TS 1.x; see `anchors.ts`). */
-function isErrorPlaceholder(t) {
+export function isErrorPlaceholder(t) {
     return ((t.flags & ts.TypeFlags.Any) !== 0 &&
         t.intrinsicName === 'error');
 }
@@ -230,7 +231,7 @@ function walkTopTypes(root, program, checker, location, flagOf) {
                 continue;
             }
             const propType = checker.getTypeOfSymbolAtLocation(prop, location);
-            walk(propType, path === '' ? prop.getName() : `${path}.${prop.getName()}`, depth + 1);
+            walk(propType, memberPath(path, prop, checker), depth + 1);
             if (exhausted)
                 return;
         }
@@ -276,8 +277,8 @@ function disqualifyingFlag(t) {
     }
     return t.flags & ts.TypeFlags.Unknown ? 'unknown' : undefined;
 }
-/** How many unresolved specifiers a detail names before it counts the rest. */
-const MAX_NAMED_SPECIFIERS = 3;
+/** How many specifiers or names a detail lists before it counts the rest. */
+const MAX_NAMED_IN_DETAIL = 3;
 /**
  * Turn a deep finding into the published provenance entry (carrick#376).
  *
@@ -321,12 +322,51 @@ function unresolvedDetail(specifiers) {
     const lead = "the type at this position did not resolve on the scanned checkout, so the compiler printed a placeholder 'any' rather than a declared type";
     if (specifiers.length === 0)
         return lead;
-    const named = specifiers
-        .slice(0, MAX_NAMED_SPECIFIERS)
-        .map((specifier) => `'${specifier}'`)
+    return `${lead}; unresolved imports reachable from the anchor: ${quotedList(specifiers)}`;
+}
+/**
+ * The entry for one position at which the emitted tree holds the
+ * unresolved-reference placeholder (carrick#1446): `path` is `''` for the
+ * alias's own type. `names` are the identifiers the self-check could not find
+ * in this alias's statement and the files it reaches.
+ *
+ * The cause is `unresolved_import`, the word a reader already has for "a
+ * reference here did not resolve"; the detail says where it failed to.
+ */
+export function unresolvedInTreeProvenance(path, names) {
+    const where = path === '' ? 'this type' : 'the type at this position';
+    const lead = `${where} does not resolve in the declarations the capture emitted, so the ` +
+        "compiler reads it as 'any' although the printed text shows the name it could not follow";
+    return {
+        path,
+        kind: 'any',
+        reason: 'unresolved_import',
+        detail: names.length === 0
+            ? lead
+            : `${lead}; names those declarations cannot find: ${quotedList(names)}`,
+    };
+}
+/**
+ * The root entry for a literal anchor demoted because its text names a module
+ * whose declaration emit was skipped (carrick#1446, carrick#1165): that text is
+ * what the index serves for it, and nothing in the emitted tree declares what
+ * it imports.
+ */
+export function unemittedModuleProvenance() {
+    return {
+        path: '',
+        kind: 'any',
+        reason: 'unresolved_import',
+        detail: 'this type names a module whose declarations the capture could not emit, so it ' +
+            "does not resolve in the declarations the capture emitted and the compiler reads it as 'any'",
+    };
+}
+/** `'a', 'b', 'c' and 2 more`. */
+function quotedList(items) {
+    const named = items
+        .slice(0, MAX_NAMED_IN_DETAIL)
+        .map((item) => `'${item}'`)
         .join(', ');
-    const more = specifiers.length > MAX_NAMED_SPECIFIERS
-        ? ` and ${specifiers.length - MAX_NAMED_SPECIFIERS} more`
-        : '';
-    return `${lead}; unresolved imports reachable from the anchor: ${named}${more}`;
+    const more = items.length > MAX_NAMED_IN_DETAIL ? ` and ${items.length - MAX_NAMED_IN_DETAIL} more` : '';
+    return `${named}${more}`;
 }

package/sidecar/dist/src/capture/guarded-fs.d.ts

@@ -42,7 +42,11 @@ export declare class WriteGuard {
     private readonly files;
     private readonly protect;
     private constructor();
-    /** A guard over `roots`. Throws when a root equals or contains a protected tree. */
+    /**
+     * A guard over `roots`. Throws when a root equals or contains a protected
+     * tree, or when a directory root lies inside one anywhere but beneath a
+     * `.carrick` directory (carrick#1768).
+     */
     static of(roots: WriteRoots): WriteGuard;
     /**
      * A new, empty directory under `parent` (the OS temp dir by default) and a

package/sidecar/dist/src/capture/guarded-fs.js

@@ -40,7 +40,11 @@ export class WriteGuard {
         this.files = files;
         this.protect = protect;
     }
-    /** A guard over `roots`. Throws when a root equals or contains a protected tree. */
+    /**
+     * A guard over `roots`. Throws when a root equals or contains a protected
+     * tree, or when a directory root lies inside one anywhere but beneath a
+     * `.carrick` directory (carrick#1768).
+     */
     static of(roots) {
         const protect = (roots.protect ?? []).map(landing);
         const dirs = (roots.dirs ?? []).map(landing);
@@ -51,6 +55,16 @@ export class WriteGuard {
                 throw new WriteRefused(`refused write root ${root}: it is or contains the scanned tree ${covered}`);
             }
         }
+        // Inside a scanned tree, a directory root is Carrick's only beneath a
+        // `.carrick` directory. Anywhere else it is the repo's own (a sibling
+        // service, say), and a stub dir is emptied before it is written. A file
+        // root is exempt: the surface entry has to sit inside rootDir.
+        for (const root of dirs) {
+            const inside = protect.find((tree) => within(tree, root) && !carrickOwned(tree, root));
+            if (inside !== undefined) {
+                throw new WriteRefused(`refused write root ${root}: it lies inside the scanned tree ${inside}, outside a .carrick directory`);
+            }
+        }
         return new WriteGuard(dirs, files, protect);
     }
     /**
@@ -133,6 +147,14 @@ function within(root, p) {
     const rel = path.relative(root, p);
     return rel === '' || (rel !== '..' && !rel.startsWith(`..${path.sep}`) && !path.isAbsolute(rel));
 }
+/**
+ * Whether `root`, inside `tree`, lies beneath a `.carrick` directory between
+ * the two. `.carrick` itself is not enough: it holds the workspace's proposal,
+ * jobs and scan logs. Both are resolved paths.
+ */
+function carrickOwned(tree, root) {
+    return path.relative(tree, root).split(path.sep).slice(0, -1).includes('.carrick');
+}
 function isDirectory(p) {
     try {
         return fs.statSync(p).isDirectory();

package/sidecar/dist/src/capture/index.js

@@ -145,10 +145,13 @@ export function captureStub(opts) {
     // Everything this capture writes, it writes through `guard` (carrick#1748):
     // the stub dir, the staging dir, and the surface entry. A stub dir is
     // emptied before it is written, so one that is or holds the repo is refused
-    // before anything is touched.
+    // before anything is touched. The scan root is protected too: a stub dir
+    // in a sibling service of the same repo is refused unless it sits beneath
+    // a `.carrick` directory (carrick#1768).
     let guard;
     try {
-        guard = WriteGuard.of({ dirs: [stubDir], protect: [repoRoot] });
+        const protect = opts.scanRoot === undefined ? [repoRoot] : [repoRoot, path.resolve(opts.scanRoot)];
+        guard = WriteGuard.of({ dirs: [stubDir], protect });
     }
     catch (err) {
         return fail(stubDir, packageName, [err instanceof Error ? err.message : String(err)]);
@@ -563,6 +566,7 @@ function demoteDanglingAliases(args) {
             serialization: 'structural_fallback',
             failureReason: `declaration emit was skipped for module '${dangling}'; ` +
                 'alias demoted to keep the partially emitted tree usable',
+            namesUnemittedModule: true,
         };
     });
     if (surfaceKey !== undefined && demoted.size > 0) {
@@ -667,11 +671,19 @@ function resolveAnchors(opts, parsed, ctx, deno) {
                 siblingSymbolSpecs.set(anchor.symbol_name, entryRelativeSpecifier(ctx.entryDir, ctx.repoRoot, anchor.source_file));
             }
         }
+        // A module specifier as the entry resolves it, under the program's own
+        // resolution (the Deno graph's, for a Deno service).
+        const entryMode = entrySource?.impliedNodeFormat;
+        const resolveFromEntry = (specifier) => (deno
+            ? deno.resolve(specifier, ctx.entryPath, options)
+            : ts.resolveModuleName(specifier, ctx.entryPath, options, ts.sys, undefined, undefined, entryMode)
+                .resolvedModule)?.resolvedFileName;
         return opts.anchors.map((request) => resolveAnchor(program, request, {
             repoRoot: ctx.repoRoot,
             entryDir: ctx.entryDir,
             placeholder: placeholders.get(request.alias),
             siblingSymbolSpecs,
+            resolveFromEntry,
         }));
     }
     finally {

package/sidecar/dist/src/capture/member-name.d.ts

@@ -0,0 +1,20 @@
+/**
+ * A member's place in a path, written the same way on every scan
+ * (carrick#1766).
+ *
+ * A member keyed by a unique symbol (`[Symbol.iterator]`, or a user's
+ * `const KEY: unique symbol`) has no name of its own. The checker escapes it as
+ * `__@<description>@<symbol id>`, and the id counts the symbols the process
+ * made before this one, so it differs between two scans of one tree and a
+ * stored sentence naming it changed on every scan. The checker prints such a
+ * member from its key instead, `[Symbol.iterator]`, which is how the source
+ * writes it.
+ *
+ * Every other member keeps `getName()`. A string key that starts with `__` is
+ * escaped with one more underscore, so it never reads as symbol-keyed here, and
+ * `symbolToString` would quote a key such as `content-type`, changing text that
+ * is already stable.
+ */
+import ts from 'typescript';
+/** `parent.name`, or `parent[KEY]` for a member keyed by a unique symbol. */
+export declare function memberPath(parent: string, member: ts.Symbol, checker: ts.TypeChecker): string;

package/sidecar/dist/src/capture/member-name.js

@@ -0,0 +1,24 @@
+/**
+ * A member's place in a path, written the same way on every scan
+ * (carrick#1766).
+ *
+ * A member keyed by a unique symbol (`[Symbol.iterator]`, or a user's
+ * `const KEY: unique symbol`) has no name of its own. The checker escapes it as
+ * `__@<description>@<symbol id>`, and the id counts the symbols the process
+ * made before this one, so it differs between two scans of one tree and a
+ * stored sentence naming it changed on every scan. The checker prints such a
+ * member from its key instead, `[Symbol.iterator]`, which is how the source
+ * writes it.
+ *
+ * Every other member keeps `getName()`. A string key that starts with `__` is
+ * escaped with one more underscore, so it never reads as symbol-keyed here, and
+ * `symbolToString` would quote a key such as `content-type`, changing text that
+ * is already stable.
+ */
+/** `parent.name`, or `parent[KEY]` for a member keyed by a unique symbol. */
+export function memberPath(parent, member, checker) {
+    if (!member.escapedName.startsWith('__@')) {
+        return parent === '' ? member.getName() : `${parent}.${member.getName()}`;
+    }
+    return `${parent}${checker.symbolToString(member)}`;
+}