typespun-codegen 0.0.7 → 0.0.9

package/README.md

@@ -4,7 +4,7 @@
 
 # typespun-codegen
 
-The TypeScript compiler and `typespun` command-line tool for
+The TypeScript compiler and `typespun-codegen` command-line tool for
 [Typespun](https://github.com/omkar273/typespun). It initializes a project,
 analyzes one TypeScript configuration declaration, and emits a deterministic
 loader for the separate [`typespun`](https://www.npmjs.com/package/typespun)
@@ -13,8 +13,9 @@ runtime package.
 [![npm](https://img.shields.io/npm/v/typespun-codegen.svg)](https://www.npmjs.com/package/typespun-codegen)
 [![license](https://img.shields.io/npm/l/typespun-codegen.svg)](LICENSE)
 
-The package name is `typespun-codegen`; the executable it provides is
-`typespun`. There is no supported programmatic compiler API in version 0.1.
+The package name is `typespun-codegen`; its direct executable is
+`typespun-codegen`. There is no supported programmatic compiler API in version
+0.1.
 
 ## Start with `init`
 
@@ -57,8 +58,8 @@ You can scaffold before installing either package with a package-qualified
 zero-install command:
 
 ```sh
-bunx --package typespun-codegen typespun init
-npx --package=typespun-codegen typespun init
+bunx --package typespun-codegen typespun-codegen init
+npx --package=typespun-codegen typespun-codegen init
 ```
 
 In that case, `init` creates the project files and exits successfully but does
@@ -73,8 +74,15 @@ bun add --dev typespun-codegen
 bun run config:generate
 ```
 
-The installed `bun typespun init` and `npx typespun init` flows are shorter and
-generate immediately because both dependencies are already present.
+The shortest installed workflow is:
+
+```sh
+bun add typespun
+bun add --dev typespun-codegen
+bun typespun init --env-prefix APP
+```
+
+After this, both dependencies are local and generation happens immediately.
 
 `init` preserves existing scripts and initialized files. Re-running it is
 byte-stable. It refuses conflicting options, input/output aliases, and an

package/dist/analyzer/analyze.d.ts

@@ -0,0 +1,4 @@
+import ts from 'typescript';
+import type { AnalyzeResult } from '../contracts.js';
+export declare function analyzeProgram(program: ts.Program, inputPath: string, envPrefix?: string): AnalyzeResult;
+//# sourceMappingURL=analyze.d.ts.map

package/dist/analyzer/analyze.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analyze.d.ts","sourceRoot":"","sources":["../../src/analyzer/analyze.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,KAAK,EACV,aAAa,EAId,MAAM,iBAAiB,CAAC;AASzB,wBAAgB,cAAc,CAC5B,OAAO,EAAE,EAAE,CAAC,OAAO,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAK,GACb,aAAa,CAqmBf"}

package/dist/analyzer/analyze.js

@@ -0,0 +1,414 @@
+import path from 'node:path';
+import ts from 'typescript';
+import { validateTypedValue } from 'typespun/generated';
+import { readAnnotations, typespunSymbols } from './annotations.js';
+import { locationOf, sortDiagnostics } from './diagnostic.js';
+import { evaluateDefault } from './default-expression.js';
+function isJavaScriptSource(node) {
+    return /\.(?:[cm]?js|jsx)$/i.test(node.getSourceFile().fileName);
+}
+export function analyzeProgram(program, inputPath, envPrefix = '') {
+    const checker = program.getTypeChecker();
+    const diagnostics = [];
+    const fields = [];
+    const report = (code, message, node) => diagnostics.push({ code, message, location: locationOf(node) });
+    const symbols = typespunSymbols(program);
+    const annotationsFor = (node) => readAnnotations(node, report, checker, symbols);
+    const source = program.getSourceFile(path.resolve(inputPath));
+    if (!source)
+        return {
+            inputPath,
+            fields,
+            diagnostics: [
+                {
+                    code: 'input_not_found',
+                    message: 'Schema input is not in the TypeScript program.',
+                    location: { file: inputPath, line: 1, column: 1 },
+                },
+            ],
+        };
+    if (isJavaScriptSource(source)) {
+        report('javascript_schema', 'JavaScript schema declarations are not supported.', source);
+        return { inputPath, fields, diagnostics: sortDiagnostics(diagnostics) };
+    }
+    const moduleSymbol = checker.getSymbolAtLocation(source);
+    const moduleExports = moduleSymbol
+        ? checker.getExportsOfModule(moduleSymbol)
+        : [];
+    const exportedSymbols = new Set(moduleExports.map((symbol) => symbol.flags & ts.SymbolFlags.Alias
+        ? checker.getAliasedSymbol(symbol)
+        : symbol));
+    const roots = source.statements.filter((node) => (ts.isInterfaceDeclaration(node) || ts.isClassDeclaration(node)) &&
+        !!node.name &&
+        exportedSymbols.has(checker.getSymbolAtLocation(node.name)) &&
+        annotationsFor(node).root);
+    if (roots.length !== 1) {
+        report('root_count', 'The input must export exactly one marked configuration root.', source);
+        return { inputPath, fields, diagnostics };
+    }
+    const root = roots[0];
+    const rootSymbol = checker.getSymbolAtLocation(root.name);
+    const exportNames = moduleExports
+        .filter((symbol) => (symbol.flags & ts.SymbolFlags.Alias
+        ? checker.getAliasedSymbol(symbol)
+        : symbol) === rootSymbol)
+        .map((symbol) => symbol.name)
+        .sort();
+    const exportName = exportNames.find((name) => name === root.name.text) ??
+        exportNames.find((name) => name !== 'default') ??
+        'default';
+    const rootExport = exportName === 'default'
+        ? { kind: 'default' }
+        : { kind: 'named', name: exportName };
+    if (root.typeParameters?.length) {
+        report('generic_schema', 'Configuration roots cannot have type parameters.', root.name ?? root);
+        return { inputPath, fields, diagnostics: sortDiagnostics(diagnostics) };
+    }
+    const rootType = checker.getTypeAtLocation(root);
+    if ((rootType.symbol?.declarations?.length ?? 0) > 1) {
+        report('declaration_merging', 'Configuration roots cannot use declaration merging.', root.name ?? root);
+        return { inputPath, fields, diagnostics: sortDiagnostics(diagnostics) };
+    }
+    for (const index of checker.getIndexInfosOfType(rootType)) {
+        report('unsupported_type', 'Index signatures are not supported.', index.declaration ?? root);
+    }
+    for (const signature of [
+        ...rootType.getCallSignatures(),
+        ...rootType.getConstructSignatures(),
+    ]) {
+        report('unsupported_type', 'Call and construct signatures are not supported.', signature.declaration ?? root);
+    }
+    const invalidMembers = new Set();
+    if (ts.isClassDeclaration(root)) {
+        for (const heritage of root.heritageClauses ?? [])
+            report('class_inheritance', 'Configuration classes cannot inherit other classes.', heritage);
+        for (const member of root.members) {
+            if (!ts.isPropertyDeclaration(member) ||
+                ts.isPrivateIdentifier(member.name) ||
+                member.modifiers?.some((modifier) => [
+                    ts.SyntaxKind.StaticKeyword,
+                    ts.SyntaxKind.PrivateKeyword,
+                    ts.SyntaxKind.ProtectedKeyword,
+                ].includes(modifier.kind))) {
+                report('invalid_class_member', 'Configuration classes allow only public instance data properties.', member);
+                invalidMembers.add(member);
+            }
+        }
+    }
+    function containsIntersection(node, seen = new Set()) {
+        if (!node)
+            return false;
+        if (ts.isIntersectionTypeNode(node))
+            return true;
+        if (ts.isParenthesizedTypeNode(node))
+            return containsIntersection(node.type, seen);
+        if (ts.isTypeReferenceNode(node) ||
+            ts.isExpressionWithTypeArguments(node)) {
+            let symbol = checker.getSymbolAtLocation(ts.isTypeReferenceNode(node) ? node.typeName : node.expression);
+            if (symbol?.flags && symbol.flags & ts.SymbolFlags.Alias)
+                symbol = checker.getAliasedSymbol(symbol);
+            if (!symbol || seen.has(symbol))
+                return false;
+            seen.add(symbol);
+            return (symbol.declarations?.some((declaration) => ts.isTypeAliasDeclaration(declaration) &&
+                containsIntersection(declaration.type, seen)) ?? false);
+        }
+        return false;
+    }
+    const validatedHeritage = new Set();
+    function validateHeritage(type) {
+        const javaScriptDeclaration = type.symbol?.declarations?.find(isJavaScriptSource);
+        if (javaScriptDeclaration) {
+            report('javascript_schema', 'JavaScript schema declarations are not supported.', javaScriptDeclaration);
+            return;
+        }
+        for (const declaration of type.symbol?.declarations ?? []) {
+            if (!ts.isInterfaceDeclaration(declaration) ||
+                validatedHeritage.has(declaration))
+                continue;
+            validatedHeritage.add(declaration);
+            for (const clause of declaration.heritageClauses ?? []) {
+                for (const base of clause.types) {
+                    if (containsIntersection(base)) {
+                        report('unsupported_type', 'Intersections are not supported in heritage.', base);
+                    }
+                    else {
+                        validateHeritage(checker.getTypeAtLocation(base));
+                    }
+                }
+            }
+        }
+    }
+    validateHeritage(rootType);
+    function kindOf(type) {
+        if (type.flags & ts.TypeFlags.String)
+            return { type: 'string' };
+        if (type.flags & ts.TypeFlags.Number)
+            return { type: 'number' };
+        if (type.flags & ts.TypeFlags.Boolean)
+            return { type: 'boolean' };
+        if (type.flags & ts.TypeFlags.StringLiteral)
+            return { type: 'enum', values: [type.value] };
+        if (type.isUnion() &&
+            type.types.every((item) => item.flags & ts.TypeFlags.StringLiteral)) {
+            return {
+                type: 'enum',
+                values: type.types.map((item) => item.value),
+            };
+        }
+        if (checker.isArrayType(type)) {
+            const element = checker.getTypeArguments(type)[0];
+            const kind = element && kindOf(element);
+            if (kind && ['string', 'number', 'boolean'].includes(kind.type))
+                return {
+                    type: 'array',
+                    element: kind.type,
+                };
+        }
+        return undefined;
+    }
+    const activeTypes = new Set();
+    const activeProperties = new Set();
+    function hasConditionalType(node, seen = new Set()) {
+        if (ts.isConditionalTypeNode(node))
+            return true;
+        if (ts.isTypeReferenceNode(node)) {
+            let symbol = checker.getSymbolAtLocation(node.typeName);
+            if (symbol?.flags && symbol.flags & ts.SymbolFlags.Alias)
+                symbol = checker.getAliasedSymbol(symbol);
+            if (symbol && !seen.has(symbol)) {
+                seen.add(symbol);
+                if (symbol.declarations?.some((declaration) => ts.isTypeAliasDeclaration(declaration) &&
+                    hasConditionalType(declaration.type, seen)))
+                    return true;
+            }
+        }
+        return (ts.forEachChild(node, (child) => hasConditionalType(child, seen) || undefined) ?? false);
+    }
+    function canChangeShape(node) {
+        if (node.type && hasConditionalType(node.type))
+            return true;
+        for (let parent = node.parent; parent && !ts.isSourceFile(parent); parent = parent.parent) {
+            if (ts.isConditionalTypeNode(parent))
+                return true;
+        }
+        return false;
+    }
+    const envNames = new Set();
+    const defaultsPaths = new Set();
+    function mergeInlineDefaults(lower, upper) {
+        if (!lower ||
+            !upper ||
+            typeof lower !== 'object' ||
+            typeof upper !== 'object' ||
+            Array.isArray(lower) ||
+            Array.isArray(upper))
+            return upper;
+        const lowerObject = lower;
+        const upperObject = upper;
+        return Object.fromEntries([
+            ...new Set([...Object.keys(lowerObject), ...Object.keys(upperObject)]),
+        ].map((key) => [
+            key,
+            Object.hasOwn(upperObject, key)
+                ? mergeInlineDefaults(lowerObject[key], upperObject[key])
+                : lowerObject[key],
+        ]));
+    }
+    function isObjectShape(type) {
+        return (!!(type.flags & ts.TypeFlags.Object) &&
+            !checker.isArrayType(type) &&
+            !checker.isTupleType(type) &&
+            checker.getIndexInfosOfType(type).length === 0 &&
+            type.getCallSignatures().length === 0 &&
+            type.getConstructSignatures().length === 0 &&
+            !(type.symbol?.declarations?.some((declaration) => program.isSourceFileDefaultLibrary(declaration.getSourceFile())) ?? false));
+    }
+    function visit(type, propertyPath, defaultsPath, optionalParents, secret, parentDefault) {
+        activeTypes.add(type);
+        for (const property of checker.getPropertiesOfType(type)) {
+            const node = property.valueDeclaration ?? property.declarations?.[0];
+            if (!node || invalidMembers.has(node))
+                continue;
+            if (isJavaScriptSource(node)) {
+                report('javascript_schema', 'JavaScript schema declarations are not supported.', node);
+                continue;
+            }
+            const annotations = annotationsFor(node);
+            if (annotations.ignore)
+                continue;
+            const name = property.getName();
+            if (!(ts.isPropertySignature(node) || ts.isPropertyDeclaration(node))) {
+                report('unsupported_type', 'Only data properties are supported.', node);
+                continue;
+            }
+            if (ts.isPropertyDeclaration(node) &&
+                (ts.isPrivateIdentifier(node.name) ||
+                    !!(ts.getCombinedModifierFlags(node) &
+                        (ts.ModifierFlags.Private |
+                            ts.ModifierFlags.Protected |
+                            ts.ModifierFlags.Static)))) {
+                report('invalid_class_member', 'Configuration classes allow only public instance data properties.', node);
+                continue;
+            }
+            // Generic types can keep producing fresh identities forever, including
+            // inheritance that substitutes a fresh type into a type-parameter field.
+            // Bound that undecidable expansion separately from proven type cycles.
+            if (activeProperties.has(node) && propertyPath.length >= 128) {
+                report('schema_too_deep', 'Generic type expansion exceeds the supported analysis depth of 128.', node);
+                continue;
+            }
+            if (!ts.isIdentifier(node.name) ||
+                ['__proto__', 'constructor', 'prototype'].includes(name)) {
+                report('invalid_property', 'Properties must use safe identifier names.', node);
+                continue;
+            }
+            if (containsIntersection(node.type)) {
+                report('unsupported_type', 'Intersections are not supported.', node);
+                continue;
+            }
+            if (annotations.key !== undefined &&
+                (!annotations.key ||
+                    annotations.key.includes('.') ||
+                    ['__proto__', 'constructor', 'prototype'].includes(annotations.key))) {
+                report('invalid_annotation', 'Key must be one nonempty, safe path segment.', node);
+                continue;
+            }
+            if (annotations.env !== undefined &&
+                !/^[A-Za-z_][A-Za-z0-9_]*$/.test(annotations.env)) {
+                report('invalid_annotation', 'Env must be a valid complete environment name.', node);
+                continue;
+            }
+            if (ts.isPropertyDeclaration(node) && node.initializer) {
+                const result = evaluateDefault(node.initializer, checker);
+                if (!result.ok) {
+                    report('invalid_default', 'Initializers must be supported static values.', node);
+                    continue;
+                }
+                if (!annotations.hasDefault) {
+                    annotations.hasDefault = true;
+                    annotations.defaultValue = result.value;
+                }
+            }
+            if (parentDefault &&
+                typeof parentDefault === 'object' &&
+                Object.hasOwn(parentDefault, name)) {
+                annotations.hasDefault = true;
+                annotations.defaultValue = mergeInlineDefaults(annotations.defaultValue, parentDefault[name]);
+            }
+            const currentPath = [...propertyPath, name];
+            const currentDefaultsPath = [...defaultsPath, annotations.key ?? name];
+            const optional = !!(property.flags & ts.SymbolFlags.Optional);
+            let propertyType = checker.getTypeOfSymbolAtLocation(property, node);
+            if (propertyType.isUnion() &&
+                propertyType.types.some((item) => item.flags & ts.TypeFlags.Null)) {
+                report('unsupported_type', 'Nullable unions are not supported.', node);
+                continue;
+            }
+            if (optional)
+                propertyType = checker.getNonNullableType(propertyType);
+            const javaScriptDeclaration = propertyType.symbol?.declarations?.find(isJavaScriptSource);
+            if (javaScriptDeclaration) {
+                report('javascript_schema', 'JavaScript schema declarations are not supported.', javaScriptDeclaration);
+                continue;
+            }
+            const kind = kindOf(propertyType);
+            const defaultsKey = JSON.stringify(currentDefaultsPath);
+            if (defaultsPaths.has(defaultsKey)) {
+                report('duplicate_defaults_path', 'Multiple fields resolve to conflicting defaults paths.', node);
+            }
+            defaultsPaths.add(defaultsKey);
+            if (!kind && isObjectShape(propertyType)) {
+                validateHeritage(propertyType);
+                if (annotations.env !== undefined)
+                    report('object_env', 'Env annotations apply only to leaves.', node);
+                const resolvesTypeParameter = node.type &&
+                    !!(checker.getTypeFromTypeNode(node.type).flags &
+                        ts.TypeFlags.TypeParameter);
+                if (activeTypes.has(propertyType) ||
+                    (activeProperties.has(node) &&
+                        !resolvesTypeParameter &&
+                        !canChangeShape(node))) {
+                    report('recursive_type', 'Circular configuration shapes are not supported.', node);
+                    continue;
+                }
+                if (checker.getPropertiesOfType(propertyType).length === 0) {
+                    report('unsupported_type', 'Empty object configuration shapes are not supported.', node);
+                    continue;
+                }
+                if (annotations.hasDefault &&
+                    (!annotations.defaultValue ||
+                        typeof annotations.defaultValue !== 'object' ||
+                        Array.isArray(annotations.defaultValue))) {
+                    report('invalid_default', 'Object fields require object defaults.', node);
+                    continue;
+                }
+                if (annotations.hasDefault &&
+                    Object.keys(annotations.defaultValue).some((key) => ['__proto__', 'constructor', 'prototype'].includes(key) ||
+                        !checker.getPropertyOfType(propertyType, key))) {
+                    report('invalid_default', 'Object defaults contain unknown or unsafe properties.', node);
+                    continue;
+                }
+                const alreadyActive = activeProperties.has(node);
+                activeProperties.add(node);
+                const fieldsBeforeVisit = fields.length;
+                const diagnosticsBeforeVisit = diagnostics.length;
+                visit(propertyType, currentPath, currentDefaultsPath, optional ? [...optionalParents, currentPath] : optionalParents, secret || annotations.secret, annotations.defaultValue);
+                if (!alreadyActive)
+                    activeProperties.delete(node);
+                if (fields.length === fieldsBeforeVisit &&
+                    diagnostics.length === diagnosticsBeforeVisit) {
+                    report('unsupported_type', 'Configuration object shapes must contain at least one included leaf.', node);
+                }
+                continue;
+            }
+            if (!kind) {
+                report('unsupported_type', 'This field type is not supported.', node);
+                continue;
+            }
+            if (annotations.hasDefault &&
+                validateTypedValue(kind, annotations.defaultValue) !== undefined) {
+                report('invalid_default', 'The inline default does not match its field type.', node);
+                continue;
+            }
+            const snake = currentPath
+                .map((part) => part
+                .replace(/([A-Z]+)([A-Z][a-z])/g, '$1_$2')
+                .replace(/([a-z0-9])([A-Z])/g, '$1_$2')
+                .toUpperCase())
+                .join('_');
+            const prefix = envPrefix.replace(/_+$/, '');
+            const envName = annotations.env ?? (prefix ? `${prefix}_${snake}` : snake);
+            if (envNames.has(envName))
+                report('duplicate_env', 'Multiple fields resolve to the same environment name.', node);
+            envNames.add(envName);
+            fields.push({
+                propertyPath: currentPath,
+                defaultsPath: currentDefaultsPath,
+                envName,
+                kind,
+                required: !optional,
+                secret: secret || annotations.secret,
+                hasDefault: annotations.hasDefault,
+                ...(annotations.hasDefault
+                    ? { defaultValue: annotations.defaultValue }
+                    : {}),
+                optionalParents,
+                location: locationOf(node),
+            });
+        }
+        activeTypes.delete(type);
+    }
+    visit(rootType, [], [], [], false);
+    if (fields.length === 0 && diagnostics.length === 0) {
+        report('unsupported_type', 'Configuration roots must contain at least one included leaf.', root);
+    }
+    return {
+        ...(diagnostics.length === 0 && root.name
+            ? { rootName: root.name.text, rootExport }
+            : {}),
+        inputPath,
+        fields,
+        diagnostics: sortDiagnostics(diagnostics),
+    };
+}

package/dist/analyzer/annotations.d.ts

@@ -0,0 +1,14 @@
+import ts from 'typescript';
+export interface Annotations {
+    root: boolean;
+    ignore: boolean;
+    secret: boolean;
+    key?: string;
+    env?: string;
+    hasDefault: boolean;
+    defaultValue?: unknown;
+}
+export type Report = (code: string, message: string, node: ts.Node) => void;
+export declare function typespunSymbols(program: ts.Program): Map<ts.Symbol, string>;
+export declare function readAnnotations(node: ts.Node, report: Report, checker?: ts.TypeChecker, symbols?: Map<ts.Symbol, string>): Annotations;
+//# sourceMappingURL=annotations.d.ts.map

package/dist/analyzer/annotations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/analyzer/annotations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC;AAE5E,wBAAgB,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CA+B3E;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,EACb,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,EAAE,CAAC,WAAW,EACxB,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,WAAW,CA+Eb"}

package/dist/analyzer/annotations.js

@@ -0,0 +1,102 @@
+import ts from 'typescript';
+import { evaluateDefault } from './default-expression.js';
+export function typespunSymbols(program) {
+    const checker = program.getTypeChecker();
+    const symbols = new Map();
+    for (const source of program.getSourceFiles()) {
+        for (const statement of source.statements) {
+            if (!(ts.isImportDeclaration(statement) || ts.isExportDeclaration(statement)))
+                continue;
+            const specifier = statement.moduleSpecifier;
+            if (!specifier ||
+                !ts.isStringLiteral(specifier) ||
+                specifier.text !== 'typespun')
+                continue;
+            const moduleSymbol = checker.getSymbolAtLocation(specifier);
+            if (!moduleSymbol)
+                continue;
+            for (const symbol of checker.getExportsOfModule(moduleSymbol)) {
+                symbols.set(symbol.flags & ts.SymbolFlags.Alias
+                    ? checker.getAliasedSymbol(symbol)
+                    : symbol, symbol.name);
+            }
+        }
+    }
+    return symbols;
+}
+export function readAnnotations(node, report, checker, symbols) {
+    const result = {
+        root: false,
+        ignore: false,
+        secret: false,
+        hasDefault: false,
+    };
+    for (const tag of ts.getJSDocTags(node)) {
+        const text = ts.getTextOfJSDocComment(tag.comment)?.trim() ?? '';
+        switch (tag.tagName.text) {
+            case 'typespun':
+                result.root = true;
+                break;
+            case 'ignore':
+                result.ignore = true;
+                break;
+            case 'secret':
+                result.secret = true;
+                break;
+            case 'key':
+                result.key = text;
+                break;
+            case 'env':
+                result.env = text;
+                break;
+            case 'default':
+                try {
+                    result.defaultValue = JSON.parse(text);
+                    result.hasDefault = true;
+                }
+                catch {
+                    report('invalid_default', 'Inline defaults must use valid JSON.', tag);
+                }
+                break;
+        }
+    }
+    if (checker && symbols && ts.canHaveDecorators(node)) {
+        for (const decorator of ts.getDecorators(node) ?? []) {
+            if (!ts.isCallExpression(decorator.expression))
+                continue;
+            const call = decorator.expression;
+            let symbol = checker.getSymbolAtLocation(call.expression);
+            if (symbol?.flags && symbol.flags & ts.SymbolFlags.Alias)
+                symbol = checker.getAliasedSymbol(symbol);
+            const name = symbol && symbols.get(symbol);
+            if (!name)
+                continue;
+            if (name === 'Config')
+                result.root = true;
+            if (name === 'Ignore')
+                result.ignore = true;
+            if (name === 'Secret')
+                result.secret = true;
+            if (name === 'Default' || name === 'Key' || name === 'Env') {
+                const value = call.arguments.length === 1 && call.arguments[0]
+                    ? evaluateDefault(call.arguments[0], checker)
+                    : { ok: false };
+                if (!value.ok) {
+                    report(name === 'Default' ? 'invalid_default' : 'invalid_annotation', 'Annotation arguments must be supported static values.', decorator);
+                    continue;
+                }
+                if (name === 'Default') {
+                    result.hasDefault = true;
+                    result.defaultValue = value.value;
+                }
+                else if (typeof value.value !== 'string')
+                    report('invalid_annotation', 'Key and Env require a string.', decorator);
+                else if (name === 'Key')
+                    result.key = value.value;
+                else
+                    result.env = value.value;
+            }
+        }
+    }
+    return result;
+}

package/dist/analyzer/default-expression.d.ts

@@ -0,0 +1,10 @@
+import ts from 'typescript';
+export type StaticValue = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+};
+/** Reads syntax only. No schema expressions or user modules are executed. */
+export declare function evaluateDefault(expression: ts.Expression, checker: ts.TypeChecker): StaticValue;
+//# sourceMappingURL=default-expression.d.ts.map

package/dist/analyzer/default-expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-expression.d.ts","sourceRoot":"","sources":["../../src/analyzer/default-expression.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAA;CAAE,CAAC;AAG3B,6EAA6E;AAC7E,wBAAgB,eAAe,CAC7B,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,OAAO,EAAE,EAAE,CAAC,WAAW,GACtB,WAAW,CAyEb"}

package/dist/analyzer/default-expression.js

@@ -0,0 +1,67 @@
+import ts from 'typescript';
+const invalid = { ok: false };
+/** Reads syntax only. No schema expressions or user modules are executed. */
+export function evaluateDefault(expression, checker) {
+    if (ts.isParenthesizedExpression(expression) ||
+        ts.isAsExpression(expression) ||
+        ts.isSatisfiesExpression(expression) ||
+        ts.isTypeAssertionExpression(expression)) {
+        return evaluateDefault(expression.expression, checker);
+    }
+    if (ts.isStringLiteral(expression))
+        return { ok: true, value: expression.text };
+    if (ts.isNumericLiteral(expression)) {
+        const value = Number(expression.text);
+        return Number.isFinite(value) ? { ok: true, value } : invalid;
+    }
+    if (expression.kind === ts.SyntaxKind.TrueKeyword)
+        return { ok: true, value: true };
+    if (expression.kind === ts.SyntaxKind.FalseKeyword)
+        return { ok: true, value: false };
+    if (ts.isPrefixUnaryExpression(expression) &&
+        expression.operator === ts.SyntaxKind.MinusToken &&
+        ts.isNumericLiteral(expression.operand)) {
+        const value = -Number(expression.operand.text);
+        return Number.isFinite(value) ? { ok: true, value } : invalid;
+    }
+    if (ts.isArrayLiteralExpression(expression)) {
+        const values = [];
+        for (const element of expression.elements) {
+            const result = evaluateDefault(element, checker);
+            if (!result.ok)
+                return invalid;
+            values.push(result.value);
+        }
+        return { ok: true, value: values };
+    }
+    if (ts.isObjectLiteralExpression(expression)) {
+        const value = {};
+        for (const property of expression.properties) {
+            if (!ts.isPropertyAssignment(property) ||
+                !(ts.isIdentifier(property.name) || ts.isStringLiteral(property.name)))
+                return invalid;
+            const key = property.name.text;
+            if (['__proto__', 'constructor', 'prototype'].includes(key) ||
+                Object.hasOwn(value, key))
+                return invalid;
+            const result = evaluateDefault(property.initializer, checker);
+            if (!result.ok)
+                return invalid;
+            value[key] = result.value;
+        }
+        return { ok: true, value };
+    }
+    if (ts.isPropertyAccessExpression(expression) ||
+        ts.isElementAccessExpression(expression)) {
+        const symbol = checker.getSymbolAtLocation(ts.isPropertyAccessExpression(expression) ? expression.name : expression);
+        if (symbol?.flags && symbol.flags & ts.SymbolFlags.EnumMember) {
+            const declaration = symbol.valueDeclaration;
+            const value = declaration && ts.isEnumMember(declaration)
+                ? checker.getConstantValue(declaration)
+                : undefined;
+            if (typeof value === 'string')
+                return { ok: true, value };
+        }
+    }
+    return invalid;
+}