carrick 0.3.124 → 0.3.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carrick",
-  "version": "0.3.124",
+  "version": "0.3.125",
   "carrickCache": {
     "cache_version": 22,
     "intent_cache_version": 2
@@ -113,11 +113,11 @@
     "zod": "^3.23.0"
   },
   "optionalDependencies": {
-    "@carrick-tools/cli-darwin-arm64": "0.3.124",
-    "@carrick-tools/cli-darwin-x64": "0.3.124",
-    "@carrick-tools/cli-linux-arm64": "0.3.124",
-    "@carrick-tools/cli-linux-x64": "0.3.124",
-    "@carrick-tools/cli-win32-x64": "0.3.124"
+    "@carrick-tools/cli-darwin-arm64": "0.3.125",
+    "@carrick-tools/cli-darwin-x64": "0.3.125",
+    "@carrick-tools/cli-linux-arm64": "0.3.125",
+    "@carrick-tools/cli-linux-x64": "0.3.125",
+    "@carrick-tools/cli-win32-x64": "0.3.125"
   },
   "devDependencies": {
     "@types/node": "^24.13.3"

package/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "carrick",
   "description": "Claude Code plugin for Carrick, which indexes TypeScript codebases across service and repository boundaries. After each edit it adds the file's routes, calls, and cross-service type mismatches to the session, and it registers Carrick's language server. It pairs with the Carrick MCP server, which lets agents search functions by intent rather than name.",
-  "version": "0.3.124",
+  "version": "0.3.125",
   "author": {
     "name": "Carrick",
     "email": "hello@carrick.tools"

package/sidecar/dist/src/capture/check-classify.js

@@ -29,6 +29,7 @@
  */
 import { decisiveAssignmentLine, unwidenedAliasOf, } from './check-probe.js';
 import { scrubDiagnostic, scrubPaths } from './check-scrub.js';
+import { onlyDeclaredOpenAny } from './deep-walk.js';
 import { describeFieldReport, fieldReportNotes, } from './check-fields.js';
 const PRIMARY_RE = /^(?<file>(?:[a-zA-Z]:)?[^(]*?)\((?<line>\d+),(?<col>\d+)\): error TS(?<code>\d+): (?<msg>.*)$/;
 /** Parse `tsc --pretty false` output into structured diagnostics. */
@@ -350,9 +351,10 @@ function onUnwidenedLines(plan, diagnostic) {
  * - its own declarations typecheck (the alias is not poisoned);
  * - the member-level walk ran over it and found no `any`/`unknown`, which
  *   would assign to whatever the other side declares;
- * - the same walk found none on the two published sides either. A mismatch
- *   that is not a fact stays the mismatch it was: the reading would be
- *   clearing it against a member that accepts anything.
+ * - the same walk found none on the two published sides either, an open
+ *   member included (carrick#2591). A mismatch that is not a fact stays the
+ *   mismatch it was: the reading would be clearing it against a member that
+ *   accepts anything.
  */
 function unwidenedReadingFits(input) {
     const { plan, probeDiags, poisonReason } = input;
@@ -364,7 +366,7 @@ function unwidenedReadingFits(input) {
     if (poisonReason(sent.service_name, unwidenedAliasOf(sent.alias)))
         return false;
     const walked = input.deepFindings?.sentUnwidened;
-    return walked !== undefined && walked.length === 0 && factness(input).resolved;
+    return walked !== undefined && walked.length === 0 && factness(input, true).resolved;
 }
 /**
  * The field-level sentence appended to a mismatch diagnostic
@@ -410,7 +412,7 @@ function namedFields(input, scrubCtx) {
  * empty. A walk that could not run leaves the verdict not-a-fact: absence of
  * findings is not evidence.
  */
-function factness(input) {
+function factness(input, strict = false) {
     const findings = input.deepFindings;
     if (!findings) {
         return {
@@ -419,6 +421,10 @@ function factness(input) {
         };
     }
     for (const side of ['sent', 'expected']) {
+        // Open members only (carrick#2591): the closed members were judged and an
+        // open one is never a mismatch, so the verdict is a fact about the type.
+        if (!strict && onlyDeclaredOpenAny(findings[side]))
+            continue;
         const first = findings[side][0];
         if (!first)
             continue;

package/sidecar/dist/src/capture/check.js

@@ -25,6 +25,7 @@ import { scrubPaths } from './check-scrub.js';
 import { assembleWorkspace, writeProbes, } from './check-workspace.js';
 import { buildPoisonIndexes } from './check-poison.js';
 import { openProbeProgram, probeDeepFindings } from './check-deep.js';
+import { onlyDeclaredOpenAny } from './deep-walk.js';
 import { pairFieldReports } from './check-fields.js';
 import { pairDispatchUnions } from './check-union.js';
 function runProcess(command, args, cwd, env) {
@@ -465,7 +466,13 @@ function deepDecayOf(plan, aliasRecords) {
         const record = aliasRecords.get(endpoint.service_name)?.get(endpoint.alias);
         // The capture emits every deep finding it made; the FIRST is the one the
         // pre-gate reads, exactly as when the walk stopped at the first hit.
-        const finding = record?.any_provenance?.[0];
+        const findings = record?.any_provenance ?? [];
+        // An `any` the source declares under a named member is an open member
+        // (carrick#2591): the pair is probed, and the compiler judges the closed
+        // members. Anything else on the record keeps the pair out of the probe.
+        if (onlyDeclaredOpenAny(findings))
+            continue;
+        const finding = findings[0];
         if (finding) {
             return { side, kind: finding.kind, path: finding.path };
         }

package/sidecar/dist/src/capture/deep-walk.d.ts

@@ -20,6 +20,14 @@ import type { TypeProvenance } from './api.js';
  * within its depth/node budget, treated as unverifiable (fail closed) rather
  * than silently clean. */
 export type DeepTopType = Pick<TypeProvenance, 'kind' | 'path'>;
+/** Cap on findings reported per alias. The FIRST one is what the check phase
+ * pre-gates on, so verdicts never depend on this number; the rest are there to
+ * tell a reader which fields are `any` (carrick#376), and a type with more
+ * than this many is already better described by "this type is not typed".
+ * The scanner mirrors it (`CAPTURE_FINDINGS_CAP` in
+ * `src/engine/type_compat_v2.rs`): a record this long may have stopped
+ * listing, so it cannot vouch for every position (carrick#1752). */
+export declare const MAX_DEEP_FINDINGS = 32;
 /**
  * Depth-bounded structural walk for a disqualifying top type at ANY depth:
  * a member, array element, index signature, type argument, or callable RETURN
@@ -76,6 +84,29 @@ export declare function findUncarriedPositions(root: ts.Type, program: ts.Progra
 /** TypeScript's unresolved-reference placeholder: `TypeFlags.Any` with the
  * internal `intrinsicName === 'error'` (stable since TS 1.x; see `anchors.ts`). */
 export declare function isErrorPlaceholder(t: ts.Type): boolean;
+/**
+ * True when a deep-walk path passes through a named member (the same rule as
+ * `path_names_a_member` in `src/engine/type_compat_v2.rs`). The walk writes a
+ * member as its name, an element or type argument as `<n>`, an index signature
+ * as `[index]` and a callable return as `()`; a path made of the last three
+ * alone sits at the root of the type or inside a container, never in a field.
+ */
+export declare function pathNamesAMember(path: string): boolean;
+/**
+ * True when every finding is an `any` the SOURCE declares under a named
+ * member (carrick#2591): an OPEN member. The policy: an open member is never
+ * a mismatch, and the closed members are judged as for a fully typed pair.
+ * `any` accepts and supplies every shape in the assignment the probe makes, so
+ * the compiler already judges only the closed members.
+ *
+ * Nothing else qualifies. A callable's return (`getData()`) is no data
+ * member. An `unknown` member rejects a narrower counterparty
+ * under assignment, so it would read as a mismatch the policy forbids; a
+ * `budget_exhausted` sentinel, a root top type and an `any` an unresolved
+ * import left say nothing about the author's intent. A list as long as the
+ * walk's cap may have stopped listing, so it cannot vouch for every position.
+ */
+export declare function onlyDeclaredOpenAny(findings: readonly TypeProvenance[]): boolean;
 /** What an anchor's SOURCE program could not resolve (carrick#1164). */
 export interface UnresolvedAtAnchor {
     /** Member paths holding the unresolved-reference placeholder. */

package/sidecar/dist/src/capture/deep-walk.js

@@ -22,7 +22,7 @@ import { memberPath } from './member-name.js';
  * The scanner mirrors it (`CAPTURE_FINDINGS_CAP` in
  * `src/engine/type_compat_v2.rs`): a record this long may have stopped
  * listing, so it cannot vouch for every position (carrick#1752). */
-const MAX_DEEP_FINDINGS = 32;
+export const MAX_DEEP_FINDINGS = 32;
 /**
  * Depth-bounded structural walk for a disqualifying top type at ANY depth:
  * a member, array element, index signature, type argument, or callable RETURN
@@ -269,6 +269,48 @@ function walkTopTypes(root, program, checker, location, flagOf) {
     rest.sort((a, b) => a.path.localeCompare(b.path));
     return [head, ...rest];
 }
+/**
+ * True when a deep-walk path passes through a named member (the same rule as
+ * `path_names_a_member` in `src/engine/type_compat_v2.rs`). The walk writes a
+ * member as its name, an element or type argument as `<n>`, an index signature
+ * as `[index]` and a callable return as `()`; a path made of the last three
+ * alone sits at the root of the type or inside a container, never in a field.
+ */
+export function pathNamesAMember(path) {
+    const rest = path.replaceAll('[index]', '').replaceAll('()', '');
+    let inArgument = false;
+    for (const c of rest) {
+        if (c === '<')
+            inArgument = true;
+        else if (c === '>')
+            inArgument = false;
+        else if (c !== '.' && !inArgument)
+            return true;
+    }
+    return false;
+}
+/**
+ * True when every finding is an `any` the SOURCE declares under a named
+ * member (carrick#2591): an OPEN member. The policy: an open member is never
+ * a mismatch, and the closed members are judged as for a fully typed pair.
+ * `any` accepts and supplies every shape in the assignment the probe makes, so
+ * the compiler already judges only the closed members.
+ *
+ * Nothing else qualifies. A callable's return (`getData()`) is no data
+ * member. An `unknown` member rejects a narrower counterparty
+ * under assignment, so it would read as a mismatch the policy forbids; a
+ * `budget_exhausted` sentinel, a root top type and an `any` an unresolved
+ * import left say nothing about the author's intent. A list as long as the
+ * walk's cap may have stopped listing, so it cannot vouch for every position.
+ */
+export function onlyDeclaredOpenAny(findings) {
+    return (findings.length > 0 &&
+        findings.length < MAX_DEEP_FINDINGS &&
+        findings.every((f) => f.kind === 'any' &&
+            f.reason === 'declared' &&
+            pathNamesAMember(f.path) &&
+            !f.path.includes('()')));
+}
 /** The disqualifier the self-check and the check phase gate on (see
  * `findDisqualifyingTopTypes`). */
 function disqualifyingFlag(t) {

package/sidecar/dist/src/capture/index.d.ts

@@ -34,7 +34,7 @@ export { sidecarCompilerOptions } from './compiler-options.js';
 export { isInsideCheckout, untrustedReadBound, UNTRUSTED_TREE_ENV, type ReadBound } from './checkout.js';
 export { serviceConfigPath } from './project-references.js';
 export { referenceRedirectOf } from './reference-redirect.js';
-export { findServiceTsconfig } from './service-config.js';
+export { findServiceTsconfig, fileConfigPath } from './service-config.js';
 export { WriteGuard } from './guarded-fs.js';
 export { installedPackageDirectory } from './installed-package-directory.js';
 export { isDeclarationFileName, packageNameOf } from './specifiers.js';

package/sidecar/dist/src/capture/index.js

@@ -52,7 +52,7 @@ export { sidecarCompilerOptions } from './compiler-options.js';
 export { isInsideCheckout, untrustedReadBound, UNTRUSTED_TREE_ENV } from './checkout.js';
 export { serviceConfigPath } from './project-references.js';
 export { referenceRedirectOf } from './reference-redirect.js';
-export { findServiceTsconfig } from './service-config.js';
+export { findServiceTsconfig, fileConfigPath } from './service-config.js';
 // carrick#2405: the per-position rows write through the guard, and name an
 // installed declaring file the way the capture's resolution walk does.
 export { WriteGuard } from './guarded-fs.js';

package/sidecar/dist/src/capture/service-config.d.ts

@@ -19,3 +19,14 @@
 export declare function findServiceTsconfig(serviceRoot: string, scanRoot?: string): string | undefined;
 /** The path with every symlink resolved; the path as given when it does not exist. */
 export declare function realPath(p: string): string;
+/**
+ * The config an editor types `file` under, for a service with none at its
+ * root (carrick#1604): the nearest `tsconfig.json`, then `jsconfig.json`, in
+ * each directory from the file's up to the service root, inclusive. The
+ * climb stops after a directory named `node_modules`, as tsserver's does. A file
+ * outside the service root, or with no config on its way up, has none.
+ *
+ * `known` caches the answer per directory; pass one map for one service so
+ * its files share the climb.
+ */
+export declare function fileConfigPath(file: string, serviceRoot: string, known?: Map<string, string | undefined>): string | undefined;

package/sidecar/dist/src/capture/service-config.js

@@ -55,3 +55,43 @@ export function realPath(p) {
         return path.resolve(p);
     }
 }
+/** The names an editor looks for in a file's directory, in order. */
+const FILE_CONFIG_NAMES = ['tsconfig.json', 'jsconfig.json'];
+/**
+ * The config an editor types `file` under, for a service with none at its
+ * root (carrick#1604): the nearest `tsconfig.json`, then `jsconfig.json`, in
+ * each directory from the file's up to the service root, inclusive. The
+ * climb stops after a directory named `node_modules`, as tsserver's does. A file
+ * outside the service root, or with no config on its way up, has none.
+ *
+ * `known` caches the answer per directory; pass one map for one service so
+ * its files share the climb.
+ */
+export function fileConfigPath(file, serviceRoot, known = new Map()) {
+    const root = path.resolve(serviceRoot);
+    const climbed = [];
+    let found;
+    let dir = path.dirname(path.resolve(file));
+    for (;;) {
+        const from = path.relative(root, dir);
+        if (from.startsWith('..') || path.isAbsolute(from))
+            break;
+        if (known.has(dir)) {
+            found = known.get(dir);
+            break;
+        }
+        climbed.push(dir);
+        const name = FILE_CONFIG_NAMES.find((n) => fs.existsSync(path.join(dir, n)));
+        if (name !== undefined) {
+            found = path.join(dir, name);
+            break;
+        }
+        // tsserver looks in a `node_modules` directory itself, then stops.
+        if (dir === root || path.basename(dir) === 'node_modules')
+            break;
+        dir = path.dirname(dir);
+    }
+    for (const d of climbed)
+        known.set(d, found);
+    return found;
+}

package/sidecar/dist/src/project-loader.d.ts

@@ -80,6 +80,16 @@ export declare class ProjectLoader {
     private denoProject;
     /** The tsconfig the service names, when the project is built from one. */
     private namedTsconfigPath;
+    /**
+     * Set when the service has no config at or above its root: each file is then
+     * typed under the nearest `tsconfig.json`/`jsconfig.json` on its way up to
+     * the service root (carrick#1604), and the default project holds the rest.
+     */
+    private inferredService;
+    /** The per-directory answers of `fileConfigPath` for this service. */
+    private readonly fileConfigs;
+    /** The reference owner rule of each config a file was found under. */
+    private readonly ownerRules;
     /** Each file's owning config (carrick#1604), resolved on first use. */
     private configPathFor;
     /** Programs built for owning projects other than the named tsconfig. */
@@ -128,6 +138,12 @@ export declare class ProjectLoader {
      * as before.
      */
     projectKeyFor(file?: string): string;
+    /**
+     * `projectKeyFor` for a service with no config at its root: the owner of the
+     * nearest config on the file's way up to the service root, or `''` (the
+     * default project, under the inferred options) for a file with none.
+     */
+    private inferredKeyFor;
     /**
      * The project behind a key from `projectKeyFor`, built on first use and
      * kept: a service whose files all belong to one project builds one.

package/sidecar/dist/src/project-loader.js

@@ -11,8 +11,9 @@
  */
 import { Project, getCompilerOptionsFromTsConfig } from 'ts-morph';
 import * as path from 'node:path';
+import ts from 'typescript';
 import * as fs from 'node:fs';
-import { DenoProject, findDenoConfig, findServiceTsconfig, referenceRedirectOf, serviceConfigPath, sidecarCompilerOptions, untrustedReadBound, } from './capture/index.js';
+import { DenoProject, findDenoConfig, fileConfigPath, findServiceTsconfig, referenceRedirectOf, serviceConfigPath, sidecarCompilerOptions, untrustedReadBound, } from './capture/index.js';
 import { moduleFormatResolutionHost } from './module-format.js';
 import { ExternalImports, registerExternalImports } from './origin.js';
 /**
@@ -92,6 +93,11 @@ const TARGET_MAP = {
     'ES2023': 10,
     'ESNext': 99,
 };
+/** Whether the config's own `compilerOptions` state `maxNodeModuleJsDepth`. */
+function statesJsDepth(configPath) {
+    const raw = ts.readConfigFile(configPath, ts.sys.readFile).config;
+    return raw?.compilerOptions?.maxNodeModuleJsDepth !== undefined;
+}
 /**
  * ProjectLoader - Manages ts-morph Project initialization and access
  *
@@ -126,6 +132,16 @@ export class ProjectLoader {
     denoProject;
     /** The tsconfig the service names, when the project is built from one. */
     namedTsconfigPath;
+    /**
+     * Set when the service has no config at or above its root: each file is then
+     * typed under the nearest `tsconfig.json`/`jsconfig.json` on its way up to
+     * the service root (carrick#1604), and the default project holds the rest.
+     */
+    inferredService = false;
+    /** The per-directory answers of `fileConfigPath` for this service. */
+    fileConfigs = new Map();
+    /** The reference owner rule of each config a file was found under. */
+    ownerRules = new Map();
     /** Each file's owning config (carrick#1604), resolved on first use. */
     configPathFor;
     /** Programs built for owning projects other than the named tsconfig. */
@@ -231,6 +247,7 @@ export class ProjectLoader {
                 }
                 else {
                     this.log('No tsconfig.json found, using default compiler options');
+                    this.inferredService = true;
                     this.buildProject = (kind) => {
                         const project = new Project({
                             ...this.fileSystemOption(),
@@ -239,7 +256,7 @@ export class ProjectLoader {
                         });
                         // Add source files from common locations
                         if (kind === 'listed')
-                            this.addDefaultSourceFiles(project);
+                            this.addDefaultSourceFiles(project, (file) => this.projectKeyFor(file) === '');
                         return project;
                     };
                 }
@@ -347,11 +364,18 @@ export class ProjectLoader {
      */
     projectFromConfig(configPath, kind = 'listed') {
         const imports = new ExternalImports();
+        const options = getCompilerOptionsFromTsConfig(configPath).options;
+        // TypeScript reads a `jsconfig.json` with an implicit depth of 2, which
+        // loads the JavaScript sources of installed packages; every other program
+        // here reads 0. A depth the config states is kept (carrick#1604).
+        if (this.inferredService && path.basename(configPath) === 'jsconfig.json' && !statesJsDepth(configPath)) {
+            options.maxNodeModuleJsDepth = 0;
+        }
         const project = new Project({
             ...this.fileSystemOption(),
             tsConfigFilePath: configPath,
             // Over the tsconfig's own options: ts-morph lays these on top.
-            compilerOptions: sidecarCompilerOptions(optionsFor(kind, getCompilerOptionsFromTsConfig(configPath).options)),
+            compilerOptions: sidecarCompilerOptions(optionsFor(kind, options)),
             skipAddingFilesFromTsConfig: kind === 'scripts',
             // Each import resolves in its file's own module format (carrick#1619),
             // a referenced project's unbuilt output reads as its source, under its
@@ -373,12 +397,33 @@ export class ProjectLoader {
      * as before.
      */
     projectKeyFor(file) {
+        if (this.inferredService)
+            return this.inferredKeyFor(file);
         if (!this.namedTsconfigPath || file === undefined)
             return '';
         this.configPathFor ??= serviceConfigPath(this.namedTsconfigPath, (d) => this.logError(d));
         const config = this.configPathFor(path.resolve(this.repoRoot, file));
         return config === this.namedTsconfigPath ? '' : config;
     }
+    /**
+     * `projectKeyFor` for a service with no config at its root: the owner of the
+     * nearest config on the file's way up to the service root, or `''` (the
+     * default project, under the inferred options) for a file with none.
+     */
+    inferredKeyFor(file) {
+        if (file === undefined)
+            return '';
+        const absolute = path.resolve(this.repoRoot, file);
+        const config = fileConfigPath(absolute, this.repoRoot, this.fileConfigs);
+        if (config === undefined)
+            return '';
+        let owner = this.ownerRules.get(config);
+        if (!owner) {
+            owner = serviceConfigPath(config, (d) => this.logError(d));
+            this.ownerRules.set(config, owner);
+        }
+        return owner(absolute);
+    }
     /**
      * The project behind a key from `projectKeyFor`, built on first use and
      * kept: a service whose files all belong to one project builds one.
@@ -512,7 +557,7 @@ export class ProjectLoader {
      * dependencies installed it cost 40 s and added nothing the compiler needs
      * (carrick#749).
      */
-    addDefaultSourceFiles(project) {
+    addDefaultSourceFiles(project, keep = () => true) {
         const globs = DEFAULT_SOURCE_PATTERNS.map((pattern) => path.join(this.repoRoot, pattern));
         // Negated last so it applies to every pattern above it.
         globs.push(`!${path.join(this.repoRoot, '**/node_modules/**')}`);
@@ -525,6 +570,8 @@ export class ProjectLoader {
             return;
         }
         for (const filePath of filePaths) {
+            if (!keep(filePath))
+                continue;
             try {
                 project.addSourceFileAtPath(filePath);
             }

package/sidecar/dist/src/type-inferrer.d.ts

@@ -1800,8 +1800,10 @@ export declare class TypeInferrer {
      *  - a cast on it: `(await request.json()) as NewWidget`;
      *  - the annotation of the binding it initialises:
      *    `const input: NewWidget = await request.json()`;
-     *  - a schema the read, or the binding that holds it, is handed to
-     *    (`schemaConsumingRead`): the schema's input is what a caller may send.
+     *  - a type the handler states for the read further on
+     *    (`statedInFunction`): a schema it is handed to, the annotation of a
+     *    name it is assigned to, a pass-through function, a cast of the whole
+     *    value.
      *
      * The first two are `typeNodeStatedAtRead`, the reading a consumer's
      * response read already gets. An annotation further out is not one of them:
@@ -2030,19 +2032,58 @@ export declare class TypeInferrer {
      */
     private middlewareBodySchemaValues;
     /**
-     * The contract of the schema a handler validates an untyped body read with
-     * (carrick#1166), or null.
-     *
-     * `read` is the located expression: the read call, or the binding that holds
-     * it. Every call in the enclosing function that takes that value as an
-     * argument is a candidate, and the schema is the call's receiver
-     * (`Schema.safeParse(body)`) or one of its other arguments
-     * (`parse(Schema, body)`). A candidate counts only when it declares schema
-     * types (`schemaOutputType` / `schemaInputType`), so a logger or a service
-     * call the body is also handed to is never read as a contract. No method or
-     * library name is matched.
-     */
-    private schemaConsumingRead;
+     * The type the function a value is made in states for it, where the
+     * compiler types the value itself `any` or `unknown` (carrick#2594), or
+     * null.
+     *
+     * `value` is the located expression: a body read, or a call whose result is
+     * untyped. The value is followed through the names that hold it: a
+     * declaration it initialises, and a name it is assigned to later
+     * (`let body: unknown; body = await read()`). At each place the value or
+     * one of those names is used whole, the source can state a type:
+     *
+     *  0. the annotation of the name that holds it (`let body: Upload`), or the
+     *     declared return type of the function that returns it unchanged (only
+     *     with `reads.returned`);
+     *  1. a schema it is handed to (`Schema.safeParse(body ?? {})`,
+     *     `parse(Schema, body)`): the schema's input is what a sender may send
+     *     (carrick#1166). A candidate counts only when it declares schema types,
+     *     so no method or library name is matched;
+     *  2. a function of the project it is handed to that returns that argument
+     *     unchanged (through casts) or an empty default: its declared return
+     *     type. A function that builds a new value from its argument is a
+     *     converter, and its return type describes what it built, never the
+     *     value it was handed, so it states nothing here;
+     *  3. a cast of the whole value (`(body as { phone: string }).phone`);
+     *  4. the parameter of a call it is handed to (only with
+     *     `reads.parameters`), where that parameter's type is a body shape once
+     *     any callable member is dropped (a function never crosses the wire).
+     *
+     * The first rank with an answer decides. A placeholder (`unknown`,
+     * `Record<string, unknown>`, any type node with `any` or `unknown` written
+     * in it) states nothing, and two different statements in one rank decide
+     * nothing: the answer is null.
+     */
+    private statedInFunction;
+    /**
+     * What a call that takes the value at argument `index` states for it:
+     * a schema among its receiver and other arguments (rank 1), a callee of the
+     * project that returns that argument unchanged (rank 2), or, with
+     * `reads.parameters`, the parameter's own type (rank 4).
+     */
+    private stateAtReceivingCall;
+    /**
+     * The project function `call` invokes, when every value it returns is its
+     * argument at `index` as it was handed in (through parentheses, casts,
+     * `satisfies` and `!`) or an empty default (`{}`, `[]`, `null`,
+     * `undefined`), and at least one return is that argument. Such a function
+     * narrows its argument, so its declared return type describes the value it
+     * was handed. Any other function builds something new from it, and is not
+     * this.
+     */
+    private passThroughFunction;
+    /** `{}`, `[]`, `null` or `undefined`: a default that states no member. */
+    private isEmptyDefault;
     /**
      * The part a validated read names when that part is not a body, or
      * `undefined` (carrick#1166).

package/sidecar/dist/src/type-inferrer.js

@@ -1996,6 +1996,27 @@ export class TypeInferrer {
             });
         }
         typeString = this.unwrapPromise(typeString, returnType);
+        // carrick#2594: the call's value is untyped (`Promise<any>`,
+        // `Promise<unknown>`), and the function it is made in states its type:
+        // it returns the value from a function with a declared return type, holds
+        // it in an annotated name, validates it with a schema, narrows it with a
+        // function that returns it unchanged, casts it whole, or hands it to a
+        // typed parameter. A function that converts the value into something new
+        // states nothing about it, and neither does a use on a failure path.
+        const untypedAnswer = typeString.trim() === 'any' || typeString.trim() === 'unknown';
+        if (untypedAnswer && func && !explicitType && !unwrapResult.wasUnwrapped && !carrierPayload) {
+            const stated = this.statedInFunction(callExpr, func, {
+                returned: true,
+                parameters: true,
+                skipFailurePaths: true,
+            });
+            if (stated) {
+                this.log(`Call result at ${where} is untyped, and its function states its type ` +
+                    `(${stated.how}); publishing that type`);
+                typeString = stated.text;
+                isExplicit = true;
+            }
+        }
         // #336: consumer analogue of the #306 producer anchor. Anchor on the
         // CALL's own payload (the rule-extracted Type, else the awaited call
         // type), peeling array levels to the element symbol + depth. Without the
@@ -2659,18 +2680,22 @@ export class TypeInferrer {
             isExplicit = true;
         }
         // carrick#1166: the read itself is untyped (`await c.req.json()` is `any`
-        // or `unknown`), and the handler validates it by handing it to a schema:
-        // `Schema.safeParse(body)`, `Schema.parse(await c.req.json())`. The schema
-        // declares what a caller may send, so its INPUT is the request contract,
-        // read the way every other request anchor reads a schema (carrick#1101).
+        // or `unknown`), and the handler states its type further on: it validates
+        // it with a schema (`Schema.safeParse(body ?? {})`, whose INPUT is the
+        // request contract, carrick#1101), assigns it to an annotated name
+        // (`let body: T; body = await c.req.json()`), narrows it with a function
+        // that returns it unchanged, or casts the whole value (carrick#2594).
         const readType = this.unwrapPromiseType(payloadType);
         if (!explicitType &&
             !unwrapResult.wasUnwrapped &&
             (readType.isAny() || readType.isUnknown())) {
-            const parsedWith = this.schemaConsumingRead(node);
+            const func = this.findContainingFunctionForNode(node);
+            const parsedWith = func
+                ? this.statedInFunction(node, func, { returned: false, parameters: false, skipFailurePaths: false })
+                : null;
             if (parsedWith) {
                 this.log(`Request locator at ${request.file_path}:${request.line_number} is an untyped read ` +
-                    "the handler validates with a schema; publishing the schema's input");
+                    `its handler states a type for (${parsedWith.how}); publishing that type`);
                 return this.declaredRequestInferredType(request, parsedWith, this.getNodeLocation(node));
             }
         }
@@ -6606,8 +6631,10 @@ export class TypeInferrer {
      *  - a cast on it: `(await request.json()) as NewWidget`;
      *  - the annotation of the binding it initialises:
      *    `const input: NewWidget = await request.json()`;
-     *  - a schema the read, or the binding that holds it, is handed to
-     *    (`schemaConsumingRead`): the schema's input is what a caller may send.
+     *  - a type the handler states for the read further on
+     *    (`statedInFunction`): a schema it is handed to, the annotation of a
+     *    name it is assigned to, a pass-through function, a cast of the whole
+     *    value.
      *
      * The first two are `typeNodeStatedAtRead`, the reading a consumer's
      * response read already gets. An annotation further out is not one of them:
@@ -6623,10 +6650,13 @@ export class TypeInferrer {
                 'reads off the platform request, as the source types that read');
             return this.createInferredType(request, statedText, true, this.getNodeLocation(read));
         }
-        const validated = this.schemaConsumingRead(read);
+        const func = this.findContainingFunctionForNode(read);
+        const validated = func
+            ? this.statedInFunction(read, func, { returned: false, parameters: false, skipFailurePaths: false })
+            : null;
         if (validated) {
             this.log(`Request at ${request.file_path}:${request.line_number} is the body its handler ` +
-                "reads off the platform request and validates with a schema; publishing the schema's input");
+                `reads off the platform request and states a type for (${validated.how}); publishing that type`);
             return this.declaredRequestInferredType(request, validated, this.getNodeLocation(read));
         }
         return null;
@@ -7285,70 +7315,280 @@ export class TypeInferrer {
         return values;
     }
     /**
-     * The contract of the schema a handler validates an untyped body read with
-     * (carrick#1166), or null.
-     *
-     * `read` is the located expression: the read call, or the binding that holds
-     * it. Every call in the enclosing function that takes that value as an
-     * argument is a candidate, and the schema is the call's receiver
-     * (`Schema.safeParse(body)`) or one of its other arguments
-     * (`parse(Schema, body)`). A candidate counts only when it declares schema
-     * types (`schemaOutputType` / `schemaInputType`), so a logger or a service
-     * call the body is also handed to is never read as a contract. No method or
-     * library name is matched.
-     */
-    schemaConsumingRead(read) {
-        const func = this.findContainingFunctionForNode(read);
-        if (!func)
-            return null;
-        const bindings = new Set();
-        const addBinding = (identifier) => {
-            const symbol = identifier?.getSymbol()?.compilerSymbol;
-            if (symbol)
-                bindings.add(symbol);
+     * The type the function a value is made in states for it, where the
+     * compiler types the value itself `any` or `unknown` (carrick#2594), or
+     * null.
+     *
+     * `value` is the located expression: a body read, or a call whose result is
+     * untyped. The value is followed through the names that hold it: a
+     * declaration it initialises, and a name it is assigned to later
+     * (`let body: unknown; body = await read()`). At each place the value or
+     * one of those names is used whole, the source can state a type:
+     *
+     *  0. the annotation of the name that holds it (`let body: Upload`), or the
+     *     declared return type of the function that returns it unchanged (only
+     *     with `reads.returned`);
+     *  1. a schema it is handed to (`Schema.safeParse(body ?? {})`,
+     *     `parse(Schema, body)`): the schema's input is what a sender may send
+     *     (carrick#1166). A candidate counts only when it declares schema types,
+     *     so no method or library name is matched;
+     *  2. a function of the project it is handed to that returns that argument
+     *     unchanged (through casts) or an empty default: its declared return
+     *     type. A function that builds a new value from its argument is a
+     *     converter, and its return type describes what it built, never the
+     *     value it was handed, so it states nothing here;
+     *  3. a cast of the whole value (`(body as { phone: string }).phone`);
+     *  4. the parameter of a call it is handed to (only with
+     *     `reads.parameters`), where that parameter's type is a body shape once
+     *     any callable member is dropped (a function never crosses the wire).
+     *
+     * The first rank with an answer decides. A placeholder (`unknown`,
+     * `Record<string, unknown>`, any type node with `any` or `unknown` written
+     * in it) states nothing, and two different statements in one rank decide
+     * nothing: the answer is null.
+     */
+    statedInFunction(value, func, reads) {
+        const holders = new Set();
+        const positions = [value];
+        const holderUse = (node) => {
+            if (!Node.isIdentifier(node))
+                return false;
+            const symbol = node.getSymbol()?.compilerSymbol;
+            return !!symbol && holders.has(symbol);
         };
-        if (Node.isIdentifier(read)) {
-            addBinding(read);
-        }
-        else {
-            const declaration = read.getFirstAncestorByKind(SyntaxKind.VariableDeclaration);
-            const initializer = declaration?.getInitializer();
-            if (declaration &&
-                initializer &&
-                this.unwrapExpressionNode(initializer) === read &&
-                Node.isIdentifier(declaration.getNameNode())) {
-                addBinding(declaration.getNameNode());
-            }
-        }
-        const carriesRead = (argument) => argument === read ||
-            (Node.isIdentifier(argument) &&
-                bindings.has(argument.getSymbol()?.compilerSymbol));
-        for (const call of func.getDescendantsOfKind(SyntaxKind.CallExpression)) {
-            const args = call.getArguments().map((arg) => this.unwrapExpressionNode(arg));
-            const carrier = args.findIndex(carriesRead);
-            if (carrier < 0)
+        const hold = (name) => {
+            if (!Node.isIdentifier(name))
+                return;
+            const symbol = name.getSymbol()?.compilerSymbol;
+            if (!symbol || holders.has(symbol))
+                return;
+            holders.add(symbol);
+            for (const id of func.getDescendantsOfKind(SyntaxKind.Identifier)) {
+                if (id === name || id.getSymbol()?.compilerSymbol !== symbol)
+                    continue;
+                const parent = id.getParent();
+                if (Node.isVariableDeclaration(parent) && parent.getNameNode() === id)
+                    continue;
+                if (Node.isBinaryExpression(parent) &&
+                    parent.getLeft() === id &&
+                    parent.getOperatorToken().getKind() === SyntaxKind.EqualsToken) {
+                    continue;
+                }
+                positions.push(id);
+            }
+        };
+        hold(value);
+        const found = [];
+        const stateNode = (rank, typeNode, at, how) => {
+            if (!typeNode || this.leavesAPositionOpen(typeNode))
+                return;
+            const text = this.structuralTextFromTypeNode(typeNode);
+            if (text)
+                found.push({ rank, text, at, how });
+        };
+        for (let i = 0; i < positions.length; i++) {
+            const position = positions[i];
+            if (reads.skipFailurePaths &&
+                position !== value &&
+                reachedOnlyOnFailure(position, func, holderUse)) {
                 continue;
-            const candidates = [];
-            const callee = call.getExpression();
-            if (Node.isPropertyAccessExpression(callee)) {
-                candidates.push(callee.getExpression());
             }
-            args.forEach((arg, index) => {
-                if (index !== carrier)
-                    candidates.push(arg);
-            });
-            for (const candidate of candidates) {
-                const candidateType = candidate.getType();
-                if (!this.schemaOutputType(candidateType, candidate) &&
-                    !this.schemaInputType(candidateType, candidate)) {
+            // Climb the wrappers that leave the value what it was: parentheses,
+            // `await`, `!`, `satisfies`, a placeholder cast, and an empty default
+            // (`body ?? {}`).
+            let outer = position;
+            for (;;) {
+                const parent = outer.getParent();
+                if (!parent)
+                    break;
+                if ((Node.isParenthesizedExpression(parent) ||
+                    Node.isAwaitExpression(parent) ||
+                    Node.isNonNullExpression(parent) ||
+                    Node.isSatisfiesExpression(parent)) &&
+                    parent.getExpression() === outer) {
+                    outer = parent;
+                    continue;
+                }
+                if ((Node.isAsExpression(parent) || Node.isTypeAssertion(parent)) &&
+                    parent.getExpression() === outer) {
+                    const typeNode = parent.getTypeNode();
+                    if (typeNode && !this.leavesAPositionOpen(typeNode)) {
+                        stateNode(3, typeNode, parent, 'a cast of the whole value');
+                        break;
+                    }
+                    outer = parent;
                     continue;
                 }
-                const contract = this.schemaContract(candidate, 'input');
-                if (contract)
-                    return contract;
+                if (Node.isBinaryExpression(parent) &&
+                    parent.getLeft() === outer &&
+                    [SyntaxKind.QuestionQuestionToken, SyntaxKind.BarBarToken].includes(parent.getOperatorToken().getKind()) &&
+                    this.isEmptyDefault(parent.getRight())) {
+                    outer = parent;
+                    continue;
+                }
+                break;
+            }
+            const parent = outer.getParent();
+            if (!parent)
+                continue;
+            if (Node.isVariableDeclaration(parent) && parent.getInitializer() === outer) {
+                stateNode(0, parent.getTypeNode(), parent, 'the annotation of the name that holds it');
+                hold(parent.getNameNode());
+                continue;
+            }
+            if (Node.isBinaryExpression(parent) &&
+                parent.getRight() === outer &&
+                parent.getOperatorToken().getKind() === SyntaxKind.EqualsToken &&
+                Node.isIdentifier(parent.getLeft())) {
+                const declaration = parent.getLeft().getSymbol()?.getValueDeclaration();
+                if (declaration && Node.isVariableDeclaration(declaration)) {
+                    stateNode(0, declaration.getTypeNode(), declaration, 'the annotation of the name it is assigned to');
+                }
+                hold(parent.getLeft());
+                continue;
+            }
+            if (reads.returned) {
+                const returnedHere = (Node.isReturnStatement(parent) &&
+                    parent.getExpression() === outer &&
+                    this.findContainingFunctionForNode(parent) === func) ||
+                    (Node.isArrowFunction(parent) && parent === func && parent.getBody() === outer);
+                if (returnedHere) {
+                    stateNode(0, func.getReturnTypeNode(), func, 'the declared return type of the function that returns it');
+                    continue;
+                }
+            }
+            if (Node.isCallExpression(parent) && parent.getArguments().includes(outer)) {
+                this.stateAtReceivingCall(parent, parent.getArguments().indexOf(outer), reads, found, stateNode);
             }
         }
-        return null;
+        if (found.length === 0)
+            return null;
+        const rank = Math.min(...found.map((entry) => entry.rank));
+        const decided = found.filter((entry) => entry.rank === rank);
+        if (new Set(decided.map((entry) => entry.text)).size !== 1) {
+            this.log(`A value at ${this.getNodeLocation(value).file_path}:${this.getNodeLocation(value).start_line} ` +
+                `is stated as ${decided.length} different types in its function; stating none`);
+            return null;
+        }
+        const [first] = decided;
+        return { text: first.text, provenance: first.provenance, at: first.at, how: first.how };
+    }
+    /**
+     * What a call that takes the value at argument `index` states for it:
+     * a schema among its receiver and other arguments (rank 1), a callee of the
+     * project that returns that argument unchanged (rank 2), or, with
+     * `reads.parameters`, the parameter's own type (rank 4).
+     */
+    stateAtReceivingCall(call, index, reads, found, stateNode) {
+        const schemaCandidates = [];
+        const callee = call.getExpression();
+        if (Node.isPropertyAccessExpression(callee))
+            schemaCandidates.push(callee.getExpression());
+        call.getArguments().forEach((argument, at) => {
+            if (at !== index)
+                schemaCandidates.push(this.unwrapExpressionNode(argument));
+        });
+        for (const candidate of schemaCandidates) {
+            const candidateType = candidate.getType();
+            if (!this.schemaOutputType(candidateType, candidate) &&
+                !this.schemaInputType(candidateType, candidate)) {
+                continue;
+            }
+            const contract = this.schemaContract(candidate, 'input');
+            if (contract) {
+                found.push({ rank: 1, text: contract.text, provenance: contract.provenance, at: call, how: 'a schema it is handed to' });
+                return;
+            }
+        }
+        const passThrough = this.passThroughFunction(call, index);
+        if (passThrough) {
+            stateNode(2, passThrough.getReturnTypeNode(), call, 'a function that returns it unchanged');
+            return;
+        }
+        if (!reads.parameters)
+            return;
+        const signature = this.project.getTypeChecker().getResolvedSignature(call);
+        const parameter = signature?.getParameters()[index];
+        const declaration = parameter?.getValueDeclaration();
+        if (!parameter || (declaration && Node.isParameterDeclaration(declaration) && declaration.isRestParameter())) {
+            return;
+        }
+        let parameterType = parameter.getTypeAtLocation(call);
+        if (parameterType.isUnion()) {
+            const bodies = parameterType.getUnionTypes().filter((part) => !this.isCallableType(part));
+            if (bodies.length !== 1)
+                return;
+            parameterType = bodies[0];
+        }
+        if (!this.isObjectShape(parameterType))
+            return;
+        const text = this.structuralTextFromType(parameterType, call);
+        if (!text || /\b(any|unknown)\b/.test(text))
+            return;
+        found.push({ rank: 4, text, at: call, how: 'the parameter of a call it is handed to' });
+    }
+    /**
+     * The project function `call` invokes, when every value it returns is its
+     * argument at `index` as it was handed in (through parentheses, casts,
+     * `satisfies` and `!`) or an empty default (`{}`, `[]`, `null`,
+     * `undefined`), and at least one return is that argument. Such a function
+     * narrows its argument, so its declared return type describes the value it
+     * was handed. Any other function builds something new from it, and is not
+     * this.
+     */
+    passThroughFunction(call, index) {
+        let symbol = call.getExpression().getSymbol();
+        if (symbol?.isAlias())
+            symbol = symbol.getAliasedSymbol() ?? symbol;
+        for (const declaration of symbol?.getDeclarations() ?? []) {
+            const fn = Node.isFunctionDeclaration(declaration) || Node.isMethodDeclaration(declaration)
+                ? declaration
+                : Node.isVariableDeclaration(declaration)
+                    ? this.unwrapExpressionNode(declaration.getInitializer())
+                    : undefined;
+            if (!fn ||
+                !(Node.isFunctionDeclaration(fn) ||
+                    Node.isMethodDeclaration(fn) ||
+                    Node.isArrowFunction(fn) ||
+                    Node.isFunctionExpression(fn)) ||
+                !fn.getBody() ||
+                fn.getSourceFile().isDeclarationFile() ||
+                fn.getSourceFile().isInNodeModules()) {
+                continue;
+            }
+            const parameter = fn.getParameters()[index];
+            const parameterSymbol = parameter?.getNameNode().getSymbol()?.compilerSymbol;
+            if (!parameter || parameter.isRestParameter() || !parameterSymbol)
+                continue;
+            const returned = this.returnedExpressions(fn);
+            let returnsArgument = false;
+            const everyReturnPasses = returned.every((expression) => {
+                let node = expression;
+                while (Node.isParenthesizedExpression(node) ||
+                    Node.isAsExpression(node) ||
+                    Node.isTypeAssertion(node) ||
+                    Node.isSatisfiesExpression(node) ||
+                    Node.isNonNullExpression(node)) {
+                    node = node.getExpression();
+                }
+                if (Node.isIdentifier(node) && node.getSymbol()?.compilerSymbol === parameterSymbol) {
+                    returnsArgument = true;
+                    return true;
+                }
+                return this.isEmptyDefault(node);
+            });
+            if (everyReturnPasses && returnsArgument)
+                return fn;
+        }
+        return undefined;
+    }
+    /** `{}`, `[]`, `null` or `undefined`: a default that states no member. */
+    isEmptyDefault(node) {
+        const bare = this.unwrapExpressionNode(node);
+        return ((Node.isObjectLiteralExpression(bare) && bare.getProperties().length === 0) ||
+            (Node.isArrayLiteralExpression(bare) && bare.getElements().length === 0) ||
+            Node.isNullLiteral(bare) ||
+            (Node.isIdentifier(bare) && bare.getText() === 'undefined'));
     }
     /**
      * The part a validated read names when that part is not a body, or