vouchington-tooling 0.31.0 → 0.32.0

package/README.md

@@ -455,6 +455,8 @@ Version one recognizes literal-key `apiResponse`, `apiNoContent`, `apiOpenApiRaw
 `ctx.pipeline`, `ctx.response.empty/buffer/xml`, `ctx.request.json/buffer`, `parseJsonBody`,
 `ctx.setStatus`, and static `Content-Type` setters. The input source files and TypeScript checker
 are the source representation; the adapter does not parse or discover a repository on its own.
+Reading the handler context in another object's computed assignment key preserves its binding;
+assignments or updates to the context itself, including side effects inside that key, still reject it.
 
 Error-only 405 routes require a terminal throw on the handler's own context. Named handlers and
 imported wrappers are followed through compiler declarations; conditional, caught, recursive,
@@ -506,6 +508,8 @@ A status setter must dominate each body emission, including separate branches; c
 aliases are followed, assigned mutable context aliases and object-literal context wrappers fail closed,
 and helper parameters must resolve to the registered caller's unchanged response context.
 Helper-owned contracts also account for response emissions in their proven caller scopes.
+Feasible assignments or deletions of response methods through canonical context aliases invalidate
+that dispatch evidence; dead, ignored, or unrelated method mutations preserve the contract.
 Indirect response `call`, `apply`, and `bind` forms fail closed, including borrowed context receivers.
 SSE frames and branded content variants reject body-forbidden 1xx, 204, 205, and 304 statuses.
 Literal bracket response methods have the same emission checks as property methods. Unrelated raw emissions

package/dist/api-contract-discovery/protocol-http-association.mjs

@@ -8,6 +8,7 @@ import { unsupportedContextAlias } from './protocol-context-alias.mjs';
 import { expressionReceiver } from './protocol-write-receiver.mjs';
 import { visit } from './response-contract-route-analysis.mjs';
 import { isSupportedProtocolCallback } from './protocol-callback-invocation.mjs';
+import { mutatesHttpResponseMethod } from './protocol-http-method-mutations.mjs';
 import { opaqueProtocolCallbackPath } from './protocol-opaque-callback.mjs';
 const responseMethods = new Set([
     'setStatus',
@@ -26,6 +27,8 @@ export function associateHttpResponse(call, response, checker, siblings) {
     const emissions = new Map();
     for (const [scope, context] of httpContextScopes(handler, checker))
         visit(scope, (node) => {
+            if (mutatesHttpResponseMethod(node, context, checker))
+                throw new Error('HTTP response context method is mutated');
             if (ts.isCallExpression(node) &&
                 executableProtocolPath(node, checker) &&
                 responseMethods.has(indirectHttpResponseMethod(node, context, checker) ?? ''))

package/dist/api-contract-discovery/protocol-http-method-mutations.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+/** A feasible write through a canonical context alias invalidates response dispatch evidence. */
+export declare function mutatesHttpResponseMethod(node: ts.Node, context: ts.Symbol, checker: ts.TypeChecker): boolean;

package/dist/api-contract-discovery/protocol-http-method-mutations.mjs

@@ -0,0 +1,31 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { contextResponseMethod } from './protocol-http-context.mjs';
+import { unwrapExpression } from './protocol-marker-analysis.mjs';
+import { executableProtocolPath } from './protocol-execution-path.mjs';
+import { opaqueProtocolCallbackPath } from './protocol-opaque-callback.mjs';
+const responseMethods = new Set([
+    'setStatus',
+    'pipeline',
+    'json',
+    'response',
+    'response.buffer',
+    'response.empty',
+]);
+/** A feasible write through a canonical context alias invalidates response dispatch evidence. */
+export function mutatesHttpResponseMethod(node, context, checker) {
+    let target;
+    if (ts.isBinaryExpression(node) &&
+        node.operatorToken.kind >= ts.SyntaxKind.FirstAssignment &&
+        node.operatorToken.kind <= ts.SyntaxKind.LastAssignment)
+        target = node.left;
+    if (ts.isDeleteExpression(node))
+        target = node.expression;
+    if ((ts.isPrefixUnaryExpression(node) || ts.isPostfixUnaryExpression(node)) &&
+        (node.operator === ts.SyntaxKind.PlusPlusToken ||
+            node.operator === ts.SyntaxKind.MinusMinusToken))
+        target = node.operand;
+    if (!target ||
+        !responseMethods.has(contextResponseMethod(unwrapExpression(target), context, checker, true) ?? ''))
+        return false;
+    return executableProtocolPath(node, checker) || opaqueProtocolCallbackPath(node, checker);
+}

package/dist/api-contract-discovery/registered-route-binding-writes.mjs

@@ -8,6 +8,14 @@ export function hasBindingWrite(declaration, checker) {
     const binding = checker.getSymbolAtLocation(declaration.name);
     let written = false;
     const referencesBinding = (node) => {
+        // Index expressions and computed property names read their keys, not write them.
+        // inspect still visits these expressions separately to detect nested side-effect writes.
+        if (ts.isComputedPropertyName(node))
+            return;
+        if (ts.isElementAccessExpression(node)) {
+            referencesBinding(node.expression);
+            return;
+        }
         if (ts.isIdentifier(node) && checker.getSymbolAtLocation(node) === binding)
             written = true;
         node.forEachChild(referencesBinding);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {