vouchington-tooling 0.33.0 → 0.35.0

package/dist/api-contract-discovery/request-validation-walker.mjs

@@ -0,0 +1,143 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { handlerBindings } from './request-validation-handler-state.mjs';
+import { httpContextInvocations } from './protocol-http-context-callers.mjs';
+import { potentiallyExecuted } from './protocol-executable-path.mjs';
+import { executedCallbackFunctions, invokedUnconditionally, } from './request-validation-callbacks.mjs';
+import { isConditionalPosition } from './request-validation-conditional.mjs';
+import { followedImplementations, inlineFunction, } from './request-validation-follow.mjs';
+import { calledFactory } from './request-validation-factory-calls.mjs';
+import { findConfig } from './request-validation-match.mjs';
+import { rawReadsAt } from './request-validation-reads.mjs';
+import { factorySite, sourceOf, validatorSite } from './request-validation-sites.mjs';
+import { createReporter } from './request-validation-report.mjs';
+import { createRegistrationScanner } from './request-validation-registration.mjs';
+import { createStateKey, emptyState, } from './request-validation-state-key.mjs';
+import { bindArguments } from './request-validation-trace.mjs';
+import { unwrapTransparentExpression } from './response-contract-route-syntax.mjs';
+/** Walks handlers and the helpers they run, collecting validation facts for one route. */
+export function createRouteWalker(config) {
+    const { checker, sourceFiles, validators, factories, executedCallbacks, protocolCache } = config;
+    const configured = [...validators, ...factories, ...executedCallbacks];
+    const facts = { validatorSites: [], factorySites: [], carrierReads: [] };
+    const report = createReporter();
+    const visited = new Map();
+    const scopeOf = (state) => ({
+        checker,
+        sourceFiles,
+        configured,
+        roots: state.roots,
+        keys: state.keys,
+        cache: protocolCache,
+    });
+    const stateKey = createStateKey();
+    const inputs = new Set();
+    const pendingReads = [];
+    const isInput = (node) => {
+        for (let current = node; current; current = current.parent)
+            if (inputs.has(current))
+                return true;
+        return false;
+    };
+    function walkFunction(fn, state) {
+        const seen = visited.get(fn) ?? new Set();
+        const key = stateKey(state);
+        if (seen.has(key))
+            return;
+        visited.set(fn, seen.add(key));
+        walk(fn.body, state);
+    }
+    /** Records a configured validator call; its input arguments are not raw reads. */
+    function reportValidator(call, state) {
+        const validator = findConfig(call.expression, validators, checker);
+        if (!validator)
+            return false;
+        const { site, inputNodes } = validatorSite(call, validator, scopeOf(state), state.conditional || isConditionalPosition(call));
+        inputNodes.forEach((node) => inputs.add(node));
+        const { conditional, ...identity } = site;
+        // A site reached both conditionally and unconditionally is unconditional.
+        report('validator', facts.validatorSites, site, call, identity).conditional &&= conditional;
+        return true;
+    }
+    /** Records a factory site once per call node; one reached both ways is unconditional. */
+    function recordFactory(call, factory, state, conditional) {
+        const site = factorySite(call, factory, scopeOf(state), conditional);
+        const { conditional: merged, ...identity } = site;
+        report('factory', facts.factorySites, site, call, identity).conditional &&= merged;
+    }
+    /** Records a configured factory call whose returned handler is a registration-time value. */
+    function reportFactory(call, state) {
+        const factory = findConfig(call.expression, factories, checker);
+        if (!factory)
+            return false;
+        recordFactory(call, factory, state, state.conditional || isConditionalPosition(call));
+        return true;
+    }
+    function visitCall(call, state) {
+        const conditional = state.conditional || isConditionalPosition(call);
+        // A handler built by a configured factory at module level and invoked here.
+        const built = calledFactory(call, factories, checker);
+        if (built)
+            recordFactory(built.call, built.config, emptyState, conditional);
+        const inline = inlineFunction(unwrapTransparentExpression(call.expression));
+        const callee = inline?.asteriskToken ? undefined : inline;
+        const via = new Set(state.via).add(call);
+        const runners = new Set(callee ? [callee] : []);
+        if (callee) {
+            const { keys, roots } = bindArguments(callee, call, scopeOf(state));
+            walkFunction(callee, { keys, roots, conditional, via });
+        }
+        for (const implementation of followedImplementations(call, scopeOf(state))) {
+            const { keys, roots } = bindArguments(implementation, call, scopeOf(state));
+            runners.add(implementation);
+            walkFunction(implementation, { keys, roots, conditional, via });
+        }
+        // Listed callbacks of a configured host take only the call's own condition.
+        for (const callback of executedCallbackFunctions(call, executedCallbacks, checker))
+            walkFunction(callback, { ...state, conditional });
+        for (const argument of call.arguments) {
+            const callback = unwrapTransparentExpression(argument);
+            if (!ts.isArrowFunction(callback) && !ts.isFunctionExpression(callback))
+                continue;
+            const { callers } = httpContextInvocations(callback, checker, protocolCache);
+            // A helper that runs the callback under its own condition makes the sites conditional.
+            if (callers.length > 0)
+                walkFunction(callback, {
+                    ...state,
+                    conditional: conditional || !invokedUnconditionally(callers, runners),
+                });
+        }
+    }
+    function walk(node, state) {
+        if (!potentiallyExecuted(node))
+            return;
+        if (ts.isCallExpression(node))
+            reportValidator(node, state);
+        for (const read of rawReadsAt(node, scopeOf(state)))
+            pendingReads.push({ node, read: { ...read, source: sourceOf(node) }, via: state.via });
+        if (ts.isCallExpression(node))
+            visitCall(node, state);
+        ts.forEachChild(node, (child) => {
+            if (!ts.isFunctionLike(child))
+                walk(child, state);
+        });
+    }
+    const scanRegistration = createRegistrationScanner(scopeOf, reportFactory);
+    return {
+        /** The collected facts; reads that only build a validator's input are left out. */
+        get facts() {
+            for (const { node, read, via } of pendingReads)
+                if (!isInput(node) && ![...via].some(isInput))
+                    report('read', facts.carrierReads, read);
+            pendingReads.length = 0;
+            return facts;
+        },
+        scanRegistration: (node) => scanRegistration(node),
+        walkHandler(proof) {
+            walkFunction(proof.node, {
+                ...handlerBindings(proof, checker),
+                conditional: proof.conditional ?? false,
+                via: emptyState.via,
+            });
+        },
+    };
+}

package/dist/api-contract-discovery/request-validation.test-helpers.d.mts

@@ -0,0 +1,39 @@
+import ts from '../contract-schema/typescript-api.mts';
+import type { ExecutedCallbackConfig, FactoryConfig, ValidatorConfig } from './request-validation-types.mts';
+/** Synthetic library modules shared by the request-validation fixtures. */
+export declare const librarySources: {
+    readonly 'lib/validation.ts': `
+    export function validateInput(ctx: any, operation: string, input?: any): boolean {
+      if (ctx.query.limit && input && operation) ctx.throw(400)
+      return true
+    }
+    export function validatePage(ctx: any, operation: string, options?: any): boolean {
+      if (ctx.query.limit && operation && options) ctx.throw(400)
+      return true
+    }
+  `;
+    readonly 'lib/factory.ts': `
+    import { validateInput } from './validation'
+    export function createThingHandler(options: any) {
+      return (ctx: any) => {
+        if (options.mode) validateInput(ctx, options.operation, { path: ctx.params })
+        ctx.status = 204
+      }
+    }
+  `;
+    readonly 'lib/reexport.ts': `export { validateInput as checkInput } from './validation'`;
+    readonly 'lib/keys.ts': `export const LIST_KEY = 'GET:/api/items'`;
+};
+export declare const validators: readonly ValidatorConfig[];
+/** Builds a program whose files can import each other, relatively or through `@lib/*`. */
+export declare function buildModuleProgram(files: Readonly<Record<string, string>>): {
+    program: ts.Program;
+    sourceFile(path: string): ts.SourceFile;
+};
+export type ModuleProgram = ReturnType<typeof buildModuleProgram>;
+/** Runs discovery over the given files with the shared configuration. */
+export declare function discover(built: ModuleProgram, paths: readonly string[], overrides?: {
+    validators?: readonly ValidatorConfig[];
+    factories?: readonly FactoryConfig[];
+    executedCallbacks?: readonly ExecutedCallbackConfig[];
+}): Record<string, import("./request-validation-types.mts").RouteValidationFacts>;

package/dist/api-contract-discovery/request-validation.test-helpers.mjs

@@ -0,0 +1,108 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { discoverRequestValidationFacts } from './request-validation-facts.mjs';
+/** Synthetic library modules shared by the request-validation fixtures. */
+export const librarySources = {
+    'lib/validation.ts': `
+    export function validateInput(ctx: any, operation: string, input?: any): boolean {
+      if (ctx.query.limit && input && operation) ctx.throw(400)
+      return true
+    }
+    export function validatePage(ctx: any, operation: string, options?: any): boolean {
+      if (ctx.query.limit && operation && options) ctx.throw(400)
+      return true
+    }
+  `,
+    'lib/factory.ts': `
+    import { validateInput } from './validation'
+    export function createThingHandler(options: any) {
+      return (ctx: any) => {
+        if (options.mode) validateInput(ctx, options.operation, { path: ctx.params })
+        ctx.status = 204
+      }
+    }
+  `,
+    'lib/reexport.ts': `export { validateInput as checkInput } from './validation'`,
+    'lib/keys.ts': `export const LIST_KEY = 'GET:/api/items'`,
+};
+export const validators = [
+    {
+        module: 'lib/validation.ts',
+        exportName: 'validateInput',
+        operationArgument: 1,
+        carriers: { kind: 'input-object', argument: 2 },
+    },
+    {
+        module: 'lib/validation',
+        exportName: 'validatePage',
+        operationArgument: 1,
+        carriers: {
+            kind: 'fixed',
+            carriers: ['query'],
+            optionCarriers: [{ argument: 2, property: 'path', carrier: 'path' }],
+        },
+    },
+];
+const factories = [
+    {
+        module: 'lib/factory.ts',
+        exportName: 'createThingHandler',
+        optionsArgument: 0,
+        operationProperty: 'operation',
+        carriers: ['path', 'body'],
+    },
+];
+const ROOT = '/virtual/';
+/** Builds a program whose files can import each other, relatively or through `@lib/*`. */
+export function buildModuleProgram(files) {
+    const sources = new Map(Object.entries(files).map(([path, text]) => [
+        `${ROOT}${path}`,
+        path.startsWith('global/') ? text : `${text}\nexport {}\n`,
+    ]));
+    const options = {
+        module: ts.ModuleKind.ESNext,
+        moduleResolution: ts.ModuleResolutionKind.Bundler,
+        baseUrl: ROOT,
+        paths: { '@lib/*': ['lib/*'] },
+        skipLibCheck: true,
+        strict: true,
+        target: ts.ScriptTarget.ESNext,
+    };
+    const host = ts.createCompilerHost(options, true);
+    const getSourceFile = host.getSourceFile.bind(host);
+    host.getSourceFile = (requested, languageVersion, ...rest) => {
+        const text = sources.get(requested);
+        return text === undefined
+            ? getSourceFile(requested, languageVersion, ...rest)
+            : ts.createSourceFile(requested, text, languageVersion, true, ts.ScriptKind.TS);
+    };
+    host.fileExists = (requested) => sources.has(requested) || ts.sys.fileExists(requested);
+    host.directoryExists = (requested) => [...sources.keys()].some((path) => path.startsWith(`${requested.replace(/\/$/, '')}/`)) ||
+        !!ts.sys.directoryExists?.(requested);
+    host.readFile = (requested) => sources.get(requested) ?? ts.sys.readFile(requested);
+    const program = ts.createProgram([...sources.keys()], options, host);
+    return {
+        program,
+        sourceFile(path) {
+            const sourceFile = program.getSourceFile(`${ROOT}${path}`);
+            const diagnostics = [
+                ...program.getSyntacticDiagnostics(sourceFile),
+                ...program.getSemanticDiagnostics(sourceFile),
+            ];
+            if (diagnostics.length > 0)
+                throw new Error(diagnostics
+                    .map((item) => ts.flattenDiagnosticMessageText(item.messageText, '\n'))
+                    .join('\n'));
+            return sourceFile;
+        },
+    };
+}
+/** Runs discovery over the given files with the shared configuration. */
+export function discover(built, paths, overrides = {}) {
+    return discoverRequestValidationFacts({
+        program: built.program,
+        sourceFiles: paths.map((path) => built.sourceFile(path)),
+        validators,
+        factories,
+        ...overrides,
+    });
+}

package/dist/api-contract-discovery/response-contract-attribution-facts.d.mts

@@ -0,0 +1,2 @@
+import type { AmbiguousAttributionFact } from './response-contract-lenient.mts';
+export declare function sortAttributionFacts(facts: readonly AmbiguousAttributionFact[]): AmbiguousAttributionFact[];

package/dist/api-contract-discovery/response-contract-attribution-facts.mjs

@@ -0,0 +1,18 @@
+export function sortAttributionFacts(facts) {
+    return [...facts].toSorted((left, right) => {
+        const first = parseSourceLocation(left.sourceLocation);
+        const second = parseSourceLocation(right.sourceLocation);
+        if (first.path !== second.path)
+            return first.path < second.path ? -1 : 1;
+        return first.line - second.line || first.column - second.column;
+    });
+}
+function parseSourceLocation(location) {
+    const columnSeparator = location.lastIndexOf(':');
+    const lineSeparator = location.lastIndexOf(':', columnSeparator - 1);
+    return {
+        path: location.slice(0, lineSeparator),
+        line: Number(location.slice(lineSeparator + 1, columnSeparator)),
+        column: Number(location.slice(columnSeparator + 1)),
+    };
+}

package/dist/api-contract-discovery/response-contract-attribution.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+import { type HandlerBindings, type AmbiguousHandlerBindings } from './response-contract-route-analysis.mts';
+export declare function ambiguousRoutesForCall(node: ts.Node, checker: ts.TypeChecker, handlerBindings: HandlerBindings, ambiguousBindings: AmbiguousHandlerBindings): readonly string[] | undefined;

package/dist/api-contract-discovery/response-contract-attribution.mjs

@@ -0,0 +1,23 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { executableProtocolPath } from './protocol-execution-path.mjs';
+import { attributionFunctionSymbol, attributionSymbol } from './response-contract-symbols.mjs';
+import { isInlineRouteHandler } from './response-contract-route-syntax.mjs';
+import {} from './response-contract-route-analysis.mjs';
+export function ambiguousRoutesForCall(node, checker, handlerBindings, ambiguousBindings) {
+    let current = node;
+    while (current) {
+        if (isInlineRouteHandler(current))
+            return undefined;
+        const symbol = attributionFunctionSymbol(current, checker);
+        if (symbol) {
+            const resolved = attributionSymbol(symbol, checker);
+            const routes = ambiguousBindings.get(resolved);
+            if (routes)
+                return executableProtocolPath(node, checker, current) ? routes : undefined;
+            if (handlerBindings.has(resolved))
+                return undefined;
+        }
+        current = current.parent;
+    }
+    return undefined;
+}

package/dist/api-contract-discovery/response-contract-call-classification.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+export type ImplicitResponseCallLabel = 'ctx.json()' | 'ctx.pipeline()' | 'ctx.response.xml()' | 'ctx.response.buffer()' | 'ctx.response.empty()';
+export declare function implicitResponseCallLabel(call: ts.CallExpression, excludeDynamicErrorObjects?: boolean, checker?: ts.TypeChecker): ImplicitResponseCallLabel | undefined;

package/dist/api-contract-discovery/response-contract-call-classification.mjs

@@ -0,0 +1,37 @@
+import ts from '../contract-schema/typescript-api.mjs';
+import { isInErrorBranch } from './response-contract-error-branch.mjs';
+import { isXmlResponseCall } from './response-contract-media.mjs';
+import { containsResponseMarker } from './response-contract-registration.mjs';
+import { isContextMethod, isContextResponseBufferCall, isContextResponseEmptyCall, } from './response-contract-route-analysis.mjs';
+import { unwrapTransparentExpression } from './response-contract-route-syntax.mjs';
+export function implicitResponseCallLabel(call, excludeDynamicErrorObjects = false, checker) {
+    if (isContextMethod(call.expression, 'json')) {
+        if (!call.arguments[0] || isInErrorBranch(call, excludeDynamicErrorObjects, checker))
+            return undefined;
+        return 'ctx.json()';
+    }
+    if (isStreamJsonPipeline(call, excludeDynamicErrorObjects))
+        return isInErrorBranch(call, excludeDynamicErrorObjects, checker) ? undefined : 'ctx.pipeline()';
+    if (excludeDynamicErrorObjects && isInErrorBranch(call, true, checker))
+        return undefined;
+    if (isXmlResponseCall(call))
+        return call.arguments[0] ? 'ctx.response.xml()' : undefined;
+    if (isContextResponseBufferCall(call.expression))
+        return 'ctx.response.buffer()';
+    if (isContextResponseEmptyCall(call.expression))
+        return 'ctx.response.empty()';
+    if (isContextMethod(call.expression, 'pipeline') && !containsResponseMarker(call))
+        return 'ctx.pipeline()';
+    return undefined;
+}
+function isStreamJsonPipeline(call, unwrapArguments) {
+    if (!isContextMethod(call.expression, 'pipeline'))
+        return false;
+    const originalBody = call.arguments[0];
+    const pipelineBody = originalBody && (unwrapArguments ? unwrapTransparentExpression(originalBody) : originalBody);
+    return (!!pipelineBody &&
+        ts.isCallExpression(pipelineBody) &&
+        ts.isIdentifier(pipelineBody.expression) &&
+        pipelineBody.expression.text === 'streamJsonObject' &&
+        !!pipelineBody.arguments[0]);
+}

package/dist/api-contract-discovery/response-contract-error-branch.d.mts

@@ -12,4 +12,4 @@ import ts from '../contract-schema/typescript-api.mts';
  * two independent, self-contained early-return guards, even though neither guard's error status
  * is in effect on the path that reaches the trailing statement.
  */
-export declare function isInErrorBranch(call: ts.CallExpression): boolean;
+export declare function isInErrorBranch(call: ts.CallExpression, excludeDynamicErrorObjects?: boolean, checker?: ts.TypeChecker): boolean;

package/dist/api-contract-discovery/response-contract-error-branch.mjs

@@ -1,5 +1,8 @@
 import ts from '../contract-schema/typescript-api.mjs';
 import { isContextMethod } from './response-contract-route-analysis.mjs';
+import { potentiallyExecuted } from './protocol-executable-path.mjs';
+import { unwrapTransparentExpression } from './response-contract-route-syntax.mjs';
+import { responseBodyExpression } from './response-contract-registration.mjs';
 /**
  * Detects a hand-rolled early-return error guard: `ctx.setStatus(NNN >= 400)` followed by a
  * response body call in the same block (e.g. `auth-me.mts`'s `ctx.setStatus(401); return
@@ -13,11 +16,18 @@ import { isContextMethod } from './response-contract-route-analysis.mjs';
  * two independent, self-contained early-return guards, even though neither guard's error status
  * is in effect on the path that reaches the trailing statement.
  */
-export function isInErrorBranch(call) {
+export function isInErrorBranch(call, excludeDynamicErrorObjects = false, checker) {
     let statement = call;
     while (!ts.isStatement(statement))
         statement = statement.parent;
-    return precededByErrorStatus(statement);
+    if (!excludeDynamicErrorObjects)
+        return precededByErrorStatus(statement);
+    const latestStatus = latestStatusSetter(statement);
+    if (!latestStatus)
+        return false;
+    if (isBareErrorStatusStatement(latestStatus, true))
+        return true;
+    return isErrorObjectJson(call, checker) && isDynamicStatusStatement(latestStatus);
 }
 /**
  * Walks outward through enclosing blocks so a `ctx.setStatus(>=400)` set before the branch's own
@@ -27,21 +37,114 @@ export function isInErrorBranch(call) {
  * bodies nested one block deeper.
  */
 function precededByErrorStatus(statement) {
+    return precededByStatus(statement, isBareErrorStatusStatement);
+}
+function precededByStatus(statement, matches) {
     const block = statement.parent;
     if (!ts.isBlock(block))
         return false;
     const index = block.statements.indexOf(statement);
-    if (block.statements.slice(0, index).some(isBareErrorStatusStatement))
+    if (block.statements.slice(0, index).some(matches))
         return true;
     const enclosing = block.parent;
-    return ts.isStatement(enclosing) ? precededByErrorStatus(enclosing) : false;
+    return ts.isStatement(enclosing) ? precededByStatus(enclosing, matches) : false;
+}
+function latestStatusSetter(statement) {
+    const block = statement.parent;
+    if (!ts.isBlock(block))
+        return undefined;
+    const index = block.statements.indexOf(statement);
+    for (let previous = index - 1; previous >= 0; previous--) {
+        const candidate = block.statements[previous];
+        if (isStatusSetterStatement(candidate)) {
+            if (potentiallyExecuted(candidate))
+                return candidate;
+            continue;
+        }
+        if (mayConditionallySetStatus(candidate))
+            return undefined;
+    }
+    const enclosing = block.parent;
+    return ts.isStatement(enclosing) ? latestStatusSetter(enclosing) : undefined;
+}
+function mayConditionallySetStatus(statement) {
+    if (ts.isFunctionDeclaration(statement) ||
+        ts.isInterfaceDeclaration(statement) ||
+        ts.isTypeAliasDeclaration(statement) ||
+        ts.isImportDeclaration(statement))
+        return false;
+    let found = false;
+    const inspect = (node) => {
+        if (node !== statement && isNestedFunction(node))
+            return;
+        if (ts.isCallExpression(node) &&
+            isContextMethod(node.expression, 'setStatus') &&
+            potentiallyExecuted(node))
+            found = true;
+        ts.forEachChild(node, inspect);
+    };
+    inspect(statement);
+    return found;
+}
+function isNestedFunction(node) {
+    return (ts.isFunctionDeclaration(node) ||
+        ts.isFunctionExpression(node) ||
+        ts.isArrowFunction(node) ||
+        ts.isMethodDeclaration(node) ||
+        ts.isGetAccessorDeclaration(node) ||
+        ts.isSetAccessorDeclaration(node) ||
+        ts.isConstructorDeclaration(node));
+}
+function isStatusSetterStatement(statement) {
+    return (ts.isExpressionStatement(statement) &&
+        ts.isCallExpression(statement.expression) &&
+        isContextMethod(statement.expression.expression, 'setStatus'));
+}
+function isDynamicStatusStatement(statement) {
+    const status = statement.expression.arguments[0];
+    return !!status && !ts.isNumericLiteral(unwrapTransparentExpression(status));
+}
+function isErrorObjectJson(call, checker) {
+    const body = responseBodyExpression(call, true);
+    const errorObject = body && resolveConstObjectAlias(unwrapTransparentExpression(body), checker);
+    return (!!errorObject &&
+        ts.isObjectLiteralExpression(errorObject) &&
+        errorObject.properties.some((property) => {
+            if (ts.isSpreadAssignment(property) || ts.isMethodDeclaration(property))
+                return false;
+            // Every remaining object-literal member has a name; spread members were excluded above.
+            const name = property.name;
+            if (ts.isIdentifier(name) || ts.isStringLiteral(name))
+                return name.text === 'error';
+            if (!ts.isComputedPropertyName(name))
+                return false;
+            const key = unwrapTransparentExpression(name.expression);
+            return ts.isStringLiteral(key) && key.text === 'error';
+        }));
+}
+function resolveConstObjectAlias(expression, checker, seen = new Set()) {
+    if (!checker || !ts.isIdentifier(expression))
+        return expression;
+    const symbol = checker.getSymbolAtLocation(expression);
+    if (!symbol || seen.has(symbol))
+        return expression;
+    seen.add(symbol);
+    const declaration = symbol.valueDeclaration;
+    if (!declaration ||
+        !ts.isVariableDeclaration(declaration) ||
+        !declaration.initializer ||
+        !ts.isVariableDeclarationList(declaration.parent) ||
+        !(declaration.parent.flags & ts.NodeFlags.Const))
+        return expression;
+    return resolveConstObjectAlias(unwrapTransparentExpression(declaration.initializer), checker, seen);
 }
-function isBareErrorStatusStatement(statement) {
+function isBareErrorStatusStatement(statement, unwrapStatus = false) {
     if (!ts.isExpressionStatement(statement))
         return false;
     const expression = statement.expression;
     if (!ts.isCallExpression(expression) || !isContextMethod(expression.expression, 'setStatus'))
         return false;
     const statusArgument = expression.arguments[0];
-    return (!!statusArgument && ts.isNumericLiteral(statusArgument) && Number(statusArgument.text) >= 400);
+    const status = statusArgument && (unwrapStatus ? unwrapTransparentExpression(statusArgument) : statusArgument);
+    return !!status && ts.isNumericLiteral(status) && Number(status.text) >= 400;
 }

package/dist/api-contract-discovery/response-contract-handler-bindings.d.mts

@@ -0,0 +1,3 @@
+import ts from '../contract-schema/typescript-api.mts';
+import type { AmbiguousHandlerBindings, HandlerBindings } from './response-contract-route-analysis.mts';
+export declare function collectHandlerBindings(sourceFiles: readonly ts.SourceFile[], checker: ts.TypeChecker, ambiguousBindings?: AmbiguousHandlerBindings): HandlerBindings;