vouchington-tooling 0.29.0 → 0.30.0

package/dist/api-contract-discovery/protocol-write-receiver.mjs

@@ -0,0 +1,79 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { unwrapExpression } from './protocol-marker-analysis.mjs';
+export function writeReceiver(call, checker) {
+    const target = unwrapExpression(call.expression);
+    if (!ts.isPropertyAccessExpression(target) || target.name.text !== 'write')
+        return undefined;
+    return expressionReceiver(target.expression, checker);
+}
+export function sameWriteReceiver(left, right) {
+    return (right !== undefined &&
+        left.root === right.root &&
+        left.path.length === right.path.length &&
+        left.path.every((part, index) => part === right.path[index]));
+}
+export function expressionReceiver(expression, checker, active = new Set()) {
+    const value = unwrapExpression(expression);
+    if (ts.isIdentifier(value)) {
+        const symbol = checker.getSymbolAtLocation(value);
+        if (!symbol)
+            return undefined;
+        return symbolReceiver(symbol, checker, active);
+    }
+    if (!ts.isPropertyAccessExpression(value))
+        return undefined;
+    const propertySymbol = checker.getSymbolAtLocation(value.name);
+    if (propertySymbol && active.has(propertySymbol))
+        return undefined;
+    const property = literalProperty(value, checker) ?? propertySymbol?.valueDeclaration;
+    const propertyActive = new Set(active);
+    if (propertySymbol)
+        propertyActive.add(propertySymbol);
+    // Object literal properties remain writable even when their variable is const.
+    // Track the original receiver for raw-write rejection; never trust a marked wrapper.
+    if (property && ts.isPropertyAssignment(property)) {
+        const receiver = expressionReceiver(property.initializer, checker, propertyActive);
+        return receiver && { ...receiver, mutableAlias: true };
+    }
+    if (property && ts.isShorthandPropertyAssignment(property)) {
+        const symbol = checker.getShorthandAssignmentValueSymbol(property);
+        const receiver = symbol && symbolReceiver(symbol, checker, propertyActive);
+        return receiver && { ...receiver, mutableAlias: true };
+    }
+    const parent = expressionReceiver(value.expression, checker, active);
+    return parent ? { ...parent, path: [...parent.path, value.name.text] } : undefined;
+}
+function symbolReceiver(symbol, checker, active) {
+    const root = symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
+    if (active.has(root))
+        return undefined;
+    const declaration = root.valueDeclaration;
+    if (declaration &&
+        ts.isVariableDeclaration(declaration) &&
+        declaration.initializer &&
+        ts.isVariableDeclarationList(declaration.parent)) {
+        const initializer = unwrapExpression(declaration.initializer);
+        if (ts.isIdentifier(initializer) || ts.isPropertyAccessExpression(initializer)) {
+            const receiver = expressionReceiver(initializer, checker, new Set(active).add(root));
+            return (receiver && {
+                ...receiver,
+                ...(!(declaration.parent.flags & ts.NodeFlags.Const) ? { mutableAlias: true } : {}),
+            });
+        }
+    }
+    return { root, path: [] };
+}
+function literalProperty(value, checker) {
+    const base = unwrapExpression(value.expression);
+    if (!ts.isIdentifier(base))
+        return undefined;
+    const declaration = checker.getSymbolAtLocation(base)?.valueDeclaration;
+    if (!declaration || !ts.isVariableDeclaration(declaration) || !declaration.initializer)
+        return undefined;
+    const initializer = unwrapExpression(declaration.initializer);
+    if (!ts.isObjectLiteralExpression(initializer))
+        return undefined;
+    return initializer.properties.find((member) => (ts.isPropertyAssignment(member) || ts.isShorthandPropertyAssignment(member)) &&
+        ts.isIdentifier(member.name) &&
+        member.name.text === value.name.text);
+}

package/dist/api-contract-discovery/query-contract-registry.mjs

@@ -1,8 +1,10 @@
 import ts from '../contract-schema/typescript-api.mjs';
+import { registerPlatformCompilerLibraries } from './protocol-platform-callbacks.mjs';
 import { extractQueryParameterDescriptor } from './query-contract-extraction.mjs';
 import { contractError } from './response-contract-registration.mjs';
 import { collectHandlerBindings, enclosingRouteBinding, visit, } from './response-contract-route-analysis.mjs';
 export function discoverApiQueryContracts(program, sourceFiles, knownResponseRoutes) {
+    registerPlatformCompilerLibraries(program);
     const checker = program.getTypeChecker();
     const handlerBindings = collectHandlerBindings(sourceFiles, checker);
     const contracts = new Map();

package/dist/api-contract-discovery/registered-route-binding-writes.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+/** Helper and factory parameter bindings must remain unchanged in their declaring source. */
+export declare function hasBindingWrite(declaration: ts.FunctionDeclaration | ts.ParameterDeclaration, checker: ts.TypeChecker): boolean;

package/dist/api-contract-discovery/registered-route-binding-writes.mjs

@@ -0,0 +1,30 @@
+import ts from '../contract-schema/typescript-api.mjs';
+/** Helper and factory parameter bindings must remain unchanged in their declaring source. */
+export function hasBindingWrite(declaration, checker) {
+    if (!declaration.name)
+        return false;
+    if (!ts.isIdentifier(declaration.name))
+        return true;
+    const binding = checker.getSymbolAtLocation(declaration.name);
+    let written = false;
+    const referencesBinding = (node) => {
+        if (ts.isIdentifier(node) && checker.getSymbolAtLocation(node) === binding)
+            written = true;
+        node.forEachChild(referencesBinding);
+    };
+    const inspect = (node) => {
+        if (ts.isBinaryExpression(node) &&
+            node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+            node.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+            referencesBinding(node.left);
+        if ((ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) &&
+            (node.operator === ts.SyntaxKind.PlusPlusToken ||
+                node.operator === ts.SyntaxKind.MinusMinusToken))
+            referencesBinding(node.operand);
+        if (ts.isForOfStatement(node) || ts.isForInStatement(node))
+            referencesBinding(node.initializer);
+        node.forEachChild(inspect);
+    };
+    inspect(declaration.getSourceFile());
+    return written;
+}

package/dist/api-contract-discovery/registered-route-catalog.mjs

@@ -1,5 +1,6 @@
 import ts from '../contract-schema/typescript-api.mjs';
 import { handlerNodes } from './registered-route-handler-analysis.mjs';
+import { isTerminal405Handler } from './registered-route-terminal-error.mjs';
 import { propertyName, routeTemplateFromExpression, visit, } from './response-contract-route-analysis.mjs';
 export const routeShape = (routeTemplate) => routeTemplate.replace(/:[^/]+/g, ':');
 export function discoverRegisteredRoutes(program, sourceFiles) {
@@ -39,7 +40,16 @@ function classifyHandler(call, checker, method, routeTemplate) {
     if (nodes.length === 0)
         throw new Error(`Cannot inspect registered route handler ${method}:${routeTemplate}`);
     let sse = false;
-    let error405 = false;
+    const proofGroups = call.arguments
+        .filter((argument) => !ts.isStringLiteral(argument))
+        .map((argument) => {
+        const proofs = [];
+        const nodes = handlerNodes(argument, checker, new Map(), new Set(), true, proofs);
+        return nodes.some(ts.isFunctionLike) ? proofs : [];
+    });
+    const error405 = proofGroups.length > 0 &&
+        proofGroups.every((handlers) => handlers.length > 0 &&
+            handlers.every((proof) => isTerminal405Handler(proof.node, checker, proof.bindings)));
     let fixedStatus;
     nodes.forEach((node) => {
         visit(node, (child) => {
@@ -64,12 +74,6 @@ function classifyHandler(call, checker, method, routeTemplate) {
                 ts.isStringLiteral(child.arguments[0]) &&
                 child.arguments[0].text.toLowerCase() === 'text/event-stream')
                 sse = true;
-            if (ts.isPropertyAccessExpression(child.expression) &&
-                child.expression.name.text === 'throw' &&
-                child.arguments[0] &&
-                ts.isNumericLiteral(child.arguments[0]) &&
-                child.arguments[0].text === '405')
-                error405 = true;
         });
     });
     if (fixedStatus !== undefined) {

package/dist/api-contract-discovery/registered-route-factory-returns.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+export declare function returnedExpressions(declaration: ts.FunctionLikeDeclaration): (ts.Expression | undefined)[];
+export declare function returnsOnEveryPath(node: ts.ConciseBody | ts.Statement): boolean;

package/dist/api-contract-discovery/registered-route-factory-returns.mjs

@@ -0,0 +1,29 @@
+import ts from '../contract-schema/typescript-api.mjs';
+export function returnedExpressions(declaration) {
+    const body = declaration.body;
+    if (!ts.isBlock(body))
+        return [body];
+    const returned = [];
+    const collect = (node) => {
+        if (node !== declaration && ts.isFunctionLike(node))
+            return;
+        if (ts.isReturnStatement(node)) {
+            returned.push(node.expression);
+            return;
+        }
+        node.forEachChild(collect);
+    };
+    body.forEachChild(collect);
+    return returned;
+}
+export function returnsOnEveryPath(node) {
+    if (ts.isBlock(node))
+        return node.statements.some(returnsOnEveryPath);
+    if (ts.isReturnStatement(node))
+        return true;
+    if (ts.isIfStatement(node))
+        return (!!node.elseStatement &&
+            returnsOnEveryPath(node.thenStatement) &&
+            returnsOnEveryPath(node.elseStatement));
+    return !ts.isStatement(node);
+}

package/dist/api-contract-discovery/registered-route-handler-analysis.d.mts

@@ -1,2 +1,6 @@
 import ts from '../contract-schema/typescript-api.mts';
-export declare function handlerNodes(argument: ts.Expression, checker: ts.TypeChecker, parameterBindings?: Map<ts.Symbol, ts.Expression>): ts.Node[];
+export type HandlerProof = {
+    node: ts.FunctionLikeDeclaration;
+    bindings: Map<ts.Symbol, ts.Expression>;
+};
+export declare function handlerNodes(argument: ts.Expression, checker: ts.TypeChecker, parameterBindings?: Map<ts.Symbol, ts.Expression>, active?: Set<ts.Node>, staticProof?: boolean, proofs?: HandlerProof[]): ts.Node[];

package/dist/api-contract-discovery/registered-route-handler-analysis.mjs

@@ -1,74 +1,118 @@
 import ts from '../contract-schema/typescript-api.mjs';
-export function handlerNodes(argument, checker, parameterBindings = new Map()) {
-    if (ts.isIdentifier(argument)) {
-        const symbol = checker.getSymbolAtLocation(argument);
-        const boundArgument = symbol && parameterBindings.get(symbol);
-        if (boundArgument)
-            return handlerNodes(boundArgument, checker, parameterBindings);
+import { returnedExpressions, returnsOnEveryPath } from './registered-route-factory-returns.mjs';
+import { runtimeParameters } from './registered-route-runtime-parameters.mjs';
+import { hasBindingWrite } from './registered-route-binding-writes.mjs';
+export function handlerNodes(argument, checker, parameterBindings = new Map(), active = new Set(), staticProof = false, proofs) {
+    const unwrapped = unwrapHandlerExpression(argument);
+    if (unwrapped !== argument)
+        return handlerNodes(unwrapped, checker, parameterBindings, active, staticProof, proofs);
+    let bound = argument;
+    const boundIdentifiers = new Set();
+    while (ts.isIdentifier(bound)) {
+        const symbol = checker.getSymbolAtLocation(bound);
+        const nextArgument = symbol && parameterBindings.get(symbol);
+        if (!nextArgument)
+            break;
+        if (boundIdentifiers.has(bound))
+            return [];
+        boundIdentifiers.add(bound);
+        bound = nextArgument;
     }
-    if (ts.isArrowFunction(argument) || ts.isFunctionExpression(argument))
+    if (bound !== argument)
+        return handlerNodes(bound, checker, parameterBindings, active, staticProof, proofs);
+    if (active.has(argument))
+        return [];
+    const next = new Set(active).add(argument);
+    if (ts.isArrowFunction(argument) || ts.isFunctionExpression(argument)) {
+        proofs?.push({ node: argument, bindings: parameterBindings });
         return [argument];
+    }
     if (ts.isCallExpression(argument)) {
-        return callableImplementations(argument.expression, checker).flatMap((implementation) => {
+        const resolvedProofs = [];
+        const groups = callableImplementations(argument.expression, checker, staticProof).map((implementation) => {
+            if (staticProof &&
+                (implementation.asteriskToken ||
+                    implementation.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword) ||
+                    runtimeParameters(implementation).some((parameter) => hasBindingWrite(parameter, checker))))
+                return [];
             const bindings = new Map(parameterBindings);
-            implementation.parameters.forEach((parameter, index) => {
+            runtimeParameters(implementation).forEach((parameter, index) => {
                 const callArgument = argument.arguments[index];
                 const symbol = checker.getSymbolAtLocation(parameter.name);
                 if (callArgument && symbol)
                     bindings.set(symbol, callArgument);
             });
-            return returnedExpressions(implementation).flatMap((returnedExpression) => handlerNodes(returnedExpression, checker, bindings));
+            const returned = returnedExpressions(implementation);
+            if (staticProof &&
+                (!returnsOnEveryPath(implementation.body) || returned.some((value) => !value)))
+                return [];
+            const results = returned.map((value) => value ? handlerNodes(value, checker, bindings, next, staticProof, resolvedProofs) : []);
+            return staticProof && results.some((result) => !result.some(ts.isFunctionLike))
+                ? []
+                : results.flat();
         });
+        if (staticProof && groups.some((group) => group.length === 0))
+            return [];
+        proofs?.push(...resolvedProofs);
+        return groups.flat();
     }
-    return declarationImplementations(argument, checker);
+    return declarationImplementations(argument, checker, next, staticProof, parameterBindings, proofs);
 }
-function callableImplementations(node, checker) {
+function callableImplementations(node, checker, staticProof = false) {
     const symbol = checker.getSymbolAtLocation(node);
     if (!symbol)
         return [];
     const resolved = symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
     const implementations = [];
     for (const declaration of resolved.declarations ?? []) {
+        if (staticProof && !hasStableBinding(declaration, checker))
+            continue;
         if (ts.isVariableDeclaration(declaration) && declaration.initializer) {
-            const initializer = declaration.initializer;
+            const initializer = unwrapHandlerExpression(declaration.initializer);
             if (ts.isArrowFunction(initializer) || ts.isFunctionExpression(initializer))
                 implementations.push(initializer);
             continue;
         }
-        if ((ts.isFunctionDeclaration(declaration) || ts.isMethodDeclaration(declaration)) &&
+        if ((ts.isFunctionDeclaration(declaration) ||
+            (!staticProof && ts.isMethodDeclaration(declaration))) &&
             declaration.body)
             implementations.push(declaration);
     }
     return implementations;
 }
-function returnedExpressions(declaration) {
-    const body = declaration.body;
-    if (!ts.isBlock(body))
-        return [body];
-    const returned = [];
-    const collect = (node) => {
-        if (node !== declaration && ts.isFunctionLike(node))
-            return;
-        if (ts.isReturnStatement(node)) {
-            if (node.expression)
-                returned.push(node.expression);
-            return;
-        }
-        node.forEachChild(collect);
-    };
-    body.forEachChild(collect);
-    return returned;
-}
-function declarationImplementations(node, checker) {
+function declarationImplementations(node, checker, active, staticProof, parameterBindings, proofs) {
     const symbol = checker.getSymbolAtLocation(node);
     if (!symbol)
         return [];
     const resolved = symbol.flags & ts.SymbolFlags.Alias ? checker.getAliasedSymbol(symbol) : symbol;
     return (resolved.declarations ?? []).flatMap((declaration) => {
-        if (ts.isFunctionDeclaration(declaration) || ts.isMethodDeclaration(declaration))
+        if (staticProof && !hasStableBinding(declaration, checker))
+            return [];
+        if (ts.isFunctionDeclaration(declaration) ||
+            (!staticProof && ts.isMethodDeclaration(declaration))) {
+            if (declaration.body)
+                proofs?.push({ node: declaration, bindings: parameterBindings });
             return declaration.body ? [declaration] : [];
+        }
         if (ts.isVariableDeclaration(declaration) && declaration.initializer)
-            return [declaration, ...handlerNodes(declaration.initializer, checker)];
+            return [
+                declaration,
+                ...handlerNodes(declaration.initializer, checker, parameterBindings, active, staticProof, proofs),
+            ];
         return [];
     });
 }
+function hasStableBinding(declaration, checker) {
+    if (ts.isVariableDeclaration(declaration))
+        return (ts.isVariableDeclarationList(declaration.parent) &&
+            !!(declaration.parent.flags & ts.NodeFlags.Const));
+    return !ts.isFunctionDeclaration(declaration) || !hasBindingWrite(declaration, checker);
+}
+function unwrapHandlerExpression(node) {
+    while (ts.isParenthesizedExpression(node) ||
+        ts.isAsExpression(node) ||
+        ts.isTypeAssertionExpression(node) ||
+        ts.isSatisfiesExpression(node))
+        node = node.expression;
+    return node;
+}

package/dist/api-contract-discovery/registered-route-runtime-parameters.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+/** TypeScript's explicit this parameter is erased and consumes no runtime argument. */
+export declare function runtimeParameters(node: ts.FunctionLikeDeclaration): ts.ParameterDeclaration[];

package/dist/api-contract-discovery/registered-route-runtime-parameters.mjs

@@ -0,0 +1,5 @@
+import ts from '../contract-schema/typescript-api.mjs';
+/** TypeScript's explicit this parameter is erased and consumes no runtime argument. */
+export function runtimeParameters(node) {
+    return node.parameters.filter((parameter) => !ts.isIdentifier(parameter.name) || parameter.name.text !== 'this');
+}

package/dist/api-contract-discovery/registered-route-terminal-error.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+/** Proves a terminal 405 on the handler's own context, rather than finding a nested throw. */
+export declare function isTerminal405Handler(node: ts.Node, checker: ts.TypeChecker, bindings?: Map<ts.Symbol, ts.Expression>): boolean;

package/dist/api-contract-discovery/registered-route-terminal-error.mjs

@@ -0,0 +1,98 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { runtimeParameters } from './registered-route-runtime-parameters.mjs';
+import { handlerNodes } from './registered-route-handler-analysis.mjs';
+/** Proves a terminal 405 on the handler's own context, rather than finding a nested throw. */
+export function isTerminal405Handler(node, checker, bindings = new Map()) {
+    if (!(ts.isArrowFunction(node) ||
+        ts.isFunctionExpression(node) ||
+        ts.isFunctionDeclaration(node) ||
+        ts.isMethodDeclaration(node)) ||
+        !node.body)
+        return false;
+    const context = runtimeParameters(node)[0]?.name;
+    const symbol = context && ts.isIdentifier(context) ? checker.getSymbolAtLocation(context) : undefined;
+    return !!symbol && terminalBody(node, symbol, checker, new Set(), true, bindings);
+}
+function terminalBody(node, context, checker, active, returned = true, bindings = new Map()) {
+    if (!node.body || node.asteriskToken || active.has(node))
+        return false;
+    if (node.parameters.some((parameter) => !ts.isIdentifier(parameter.name) ||
+        parameter.dotDotDotToken ||
+        (parameter.initializer && !ts.isLiteralExpression(parameter.initializer))))
+        return false;
+    const next = new Set(active).add(node);
+    if (!ts.isBlock(node.body))
+        return terminalCall(node.body, context, checker, next, returned, bindings);
+    const statements = node.body.statements;
+    const terminal = statements.at(-1);
+    if (!terminal ||
+        !statements.slice(0, -1).every((statement) => isInertStatement(statement, context, checker)))
+        return false;
+    if (ts.isExpressionStatement(terminal))
+        return terminalCall(terminal.expression, context, checker, next, false, bindings);
+    return (ts.isReturnStatement(terminal) &&
+        !!terminal.expression &&
+        terminalCall(terminal.expression, context, checker, next, returned, bindings));
+}
+function terminalCall(expression, context, checker, active, returned, bindings) {
+    if (ts.isAwaitExpression(expression))
+        return terminalCall(expression.expression, context, checker, active, true, bindings);
+    if (ts.isParenthesizedExpression(expression))
+        return terminalCall(expression.expression, context, checker, active, returned, bindings);
+    if (!ts.isCallExpression(expression) || expression.questionDotToken)
+        return false;
+    if (expression.arguments.some((argument) => !ts.isIdentifier(argument) && !ts.isLiteralExpression(argument)))
+        return false;
+    const callee = expression.expression;
+    if (ts.isPropertyAccessExpression(callee) && callee.name.text === 'throw') {
+        const status = expression.arguments[0];
+        return (!callee.questionDotToken &&
+            ts.isIdentifier(callee.expression) &&
+            checker.getSymbolAtLocation(callee.expression) === context &&
+            !!status &&
+            ts.isNumericLiteral(status) &&
+            Number(status.text) === 405);
+    }
+    if (!ts.isIdentifier(callee))
+        return false;
+    const implementations = [];
+    handlerNodes(callee, checker, bindings, new Set(), true, implementations);
+    if (!returned && checker.getPropertyOfType(checker.getTypeAtLocation(expression), 'then'))
+        return false;
+    return (implementations.length > 0 &&
+        implementations.every(({ node: implementation, bindings: captured }) => {
+            if (!returned &&
+                implementation.modifiers?.some((modifier) => modifier.kind === ts.SyntaxKind.AsyncKeyword))
+                return false;
+            const index = expression.arguments.findIndex((argument) => ts.isIdentifier(argument) && checker.getSymbolAtLocation(argument) === context);
+            const parameter = runtimeParameters(implementation)[index]?.name;
+            const symbol = parameter && ts.isIdentifier(parameter) ? checker.getSymbolAtLocation(parameter) : undefined;
+            return !!symbol && terminalBody(implementation, symbol, checker, active, returned, captured);
+        }));
+}
+function isInertStatement(statement, context, checker) {
+    if (ts.isEmptyStatement(statement))
+        return true;
+    if (ts.isExpressionStatement(statement)) {
+        const expression = statement.expression;
+        if (ts.isStringLiteral(expression))
+            return true;
+        if (!ts.isCallExpression(expression) || expression.arguments.length !== 2)
+            return false;
+        const callee = expression.expression;
+        const [header, value] = expression.arguments;
+        return (ts.isPropertyAccessExpression(callee) &&
+            callee.name.text === 'set' &&
+            ts.isIdentifier(callee.expression) &&
+            checker.getSymbolAtLocation(callee.expression) === context &&
+            ts.isStringLiteral(header) &&
+            header.text.toLowerCase() === 'allow' &&
+            ts.isStringLiteral(value) &&
+            /^[A-Z]+(?:, *[A-Z]+)*$/.test(value.text));
+    }
+    if (!ts.isVariableStatement(statement))
+        return false;
+    return statement.declarationList.declarations.every((declaration) => ts.isIdentifier(declaration.name) &&
+        checker.getSymbolAtLocation(declaration.name) !== context &&
+        (!declaration.initializer || ts.isLiteralExpression(declaration.initializer)));
+}

package/dist/api-contract-discovery/request-contract-registry.mjs

@@ -1,4 +1,5 @@
 import ts from '../contract-schema/typescript-api.mjs';
+import { registerPlatformCompilerLibraries } from './protocol-platform-callbacks.mjs';
 import { extractContractSchema } from '../contract-schema/index.mjs';
 import { registerRequestRouteContract, } from './request-contract-lenient.mjs';
 import { discoverImplicitRequestContract } from './request-contract-implicit.mjs';
@@ -14,6 +15,7 @@ import { collectHandlerBindings, enclosingRouteBinding, visit, } from './respons
  * `apiNoRequestBody` suppression) so Phase 2 knows to never harvest over it.
  */
 export function discoverApiRequestContracts(program, sourceFiles, requestedKeys, options) {
+    registerPlatformCompilerLibraries(program);
     const checker = program.getTypeChecker();
     const contracts = new Map();
     const markerKeys = new Set();

package/dist/api-contract-discovery/response-contract-implicit.mjs

@@ -6,11 +6,34 @@ import { isXmlResponseCall, streamingTextMediaType } from './response-contract-m
 import { markBufferedRouteUnavailable, registerRouteContract, } from './response-contract-lenient.mjs';
 import { enclosingRouteBinding, isContextMethod, isContextResponseBufferCall, isContextResponseEmptyCall, requestedKeyForBinding, responseMarker, } from './response-contract-route-analysis.mjs';
 import { resolveEmissionStatus } from './response-contract-status.mjs';
+import { opaqueHttpResponse, unsupportedContextResponse, supportedResponseContext, } from './protocol-http-association.mjs';
+import { contextResponseMethod } from './protocol-http-context.mjs';
+import { taintRouteKeys, markRouteTaint, isSseSetter } from './protocol-http-implicit-taint.mjs';
 export function discoverImplicitContract(call, checker, sourceFile, contracts, handlerBindings, requestedKeys, options) {
-    const binding = enclosingRouteBinding(call, checker, handlerBindings);
+    const opaqueResponse = opaqueHttpResponse(call, checker);
+    const binding = enclosingRouteBinding(call, checker, handlerBindings, !opaqueResponse);
     if (!binding)
         return;
     const key = requestedKeyForBinding(binding, requestedKeys);
+    const taintKeys = taintRouteKeys(contracts, binding, key);
+    if (!taintKeys.length)
+        return;
+    const context = supportedResponseContext(call, checker);
+    const bracketResponse = context &&
+        (ts.isElementAccessExpression(call.expression) ||
+            (ts.isPropertyAccessExpression(call.expression) &&
+                ts.isElementAccessExpression(call.expression.expression))) &&
+        contextResponseMethod(call.expression, context, checker);
+    const mutableResponse = unsupportedContextResponse(call, checker);
+    const sseSetter = isSseSetter(contracts, binding, bracketResponse || undefined);
+    if (opaqueResponse ||
+        mutableResponse ||
+        (bracketResponse && !sseSetter && !containsResponseMarker(call))) {
+        markRouteTaint(contracts, taintKeys, binding, sourceLocation(sourceFile, call), !!mutableResponse &&
+            !!context &&
+            !!contextResponseMethod(call.expression, context, checker, true));
+        return;
+    }
     if (!key)
         return;
     const body = responseBodyExpression(call);
@@ -30,17 +53,13 @@ export function discoverImplicitContract(call, checker, sourceFile, contracts, h
             mediaTypeKnowledge: 'known',
             ...status,
         };
-        // Primary body (bare key, or requested key in subset mode) uses the lenient path, so a
-        // genuine single-variant route still reports a real `unavailableReason` on failure.
+        // Keep primary extraction failures unavailable in both full and subset discovery.
         if (requestedKeys || !contracts.has(key)) {
             registerRouteContract(contracts, key, binding, location, emission, extract, options);
             return;
         }
-        // Full-scope discovery: a route can emit more than one distinct unmarked success body across
-        // branches (e.g. a webhook's `{received}` vs `{ignored}`); register each under its own key —
-        // `groupContractsByRoute` merges by method/routeTemplate, not this key. This route already has
-        // a primary contract, so retain this one under a deterministic variant key. A failed secondary
-        // extraction is registered as unavailable so the operation never silently omits a real branch.
+        // Preserve every additional unmarked body under a deterministic variant key, including
+        // unavailable secondary extractions. Route grouping merges these without hiding a branch.
         registerRouteContract(contracts, nextImplicitVariantKey(contracts, key), binding, location, emission, extract, options);
         return;
     }
@@ -72,8 +91,7 @@ export function discoverImplicitContract(call, checker, sourceFile, contracts, h
         }, () => extractContractSchema(checker.getStringType(), checker, location, options), options);
         return;
     }
-    // Empty and raw branches can coexist; AST order must not let empty hide an unmarked raw body,
-    // so every buffer or pipeline without an explicit response marker makes the route unavailable.
+    // Empty branches must not hide any unmarked buffer or pipeline body.
     if (isContextResponseBufferCall(call.expression) ||
         (isContextMethod(call.expression, 'pipeline') && !body && !containsResponseMarker(call))) {
         markBufferedRouteUnavailable(contracts, key, binding, sourceLocation(sourceFile, call));

package/dist/api-contract-discovery/response-contract-registry.mjs

@@ -1,13 +1,24 @@
 import ts from '../contract-schema/typescript-api.mjs';
+import { registerPlatformCompilerLibraries } from './protocol-platform-callbacks.mjs';
+import { requestedProtocolKey } from './protocol-requested-keys.mjs';
+import { discoverProtocolContracts } from './protocol-contract-registry.mjs';
 import { discoverImplicitContract } from './response-contract-implicit.mjs';
 import { registerRouteContract, } from './response-contract-lenient.mjs';
 import { binaryContentContract, contractError, extractBodyContract, noContentContract, sourceLocation, } from './response-contract-registration.mjs';
 import { collectHandlerBindings, enclosingRouteBinding, isContextMethod, responseMarker, visit, } from './response-contract-route-analysis.mjs';
 import { resolveEmissionStatus } from './response-contract-status.mjs';
 export function discoverApiResponseContracts(program, sourceFiles, requestedKeys, options) {
+    registerPlatformCompilerLibraries(program);
     const checker = program.getTypeChecker();
     const contracts = new Map();
     const handlerBindings = collectHandlerBindings(sourceFiles, checker);
+    const protocolContracts = new Map();
+    const protocolEmissions = discoverProtocolContracts(sourceFiles, checker, handlerBindings, protocolContracts, options, requestedKeys);
+    for (const [key, contract] of protocolContracts) {
+        const requestedKey = requestedProtocolKey(key, contract, requestedKeys);
+        if (requestedKey)
+            contracts.set(requestedKey, contract);
+    }
     for (const sourceFile of sourceFiles) {
         visit(sourceFile, (node) => {
             if (!ts.isCallExpression(node))
@@ -47,7 +58,9 @@ export function discoverApiResponseContracts(program, sourceFiles, requestedKeys
     }
     for (const sourceFile of sourceFiles) {
         visit(sourceFile, (node) => {
-            if (!ts.isCallExpression(node) || responseMarker(node.expression))
+            if (!ts.isCallExpression(node) ||
+                responseMarker(node.expression) ||
+                protocolEmissions.has(node))
                 return;
             discoverImplicitContract(node, checker, sourceFile, contracts, handlerBindings, requestedKeys, options);
         });

package/dist/api-contract-discovery/response-contract-route-analysis.d.mts

@@ -6,7 +6,7 @@ export type RouteBinding = {
 };
 export type HandlerBindings = Map<ts.Symbol, RouteBinding>;
 export declare function requestedKeyForBinding(binding: RouteBinding, requestedKeys?: ReadonlySet<string>): string | undefined;
-export declare function enclosingRouteBinding(node: ts.Node, checker: ts.TypeChecker, handlerBindings: HandlerBindings): RouteBinding | undefined;
+export declare function enclosingRouteBinding(node: ts.Node, checker: ts.TypeChecker, handlerBindings: HandlerBindings, proveCallbacks?: boolean): RouteBinding | undefined;
 export declare function collectHandlerBindings(sourceFiles: readonly ts.SourceFile[], checker: ts.TypeChecker): HandlerBindings;
 export declare function routeTemplateFromExpression(expression: ts.Expression): string | undefined;
 export declare function propertyName(expression: ts.Expression): string | undefined;