The path/type index over a datamodel document (sb ADR-0006, accepted 2026-08-29), and the projections that record promises.

ADR-0006 defines the document: a version plus three scopes - global, local, event - each carrying entries with name, path, type and label, plus the optional fields, item_type, example, note and one_of. Decision 5 makes every path absolute and globally addressable (an event entry spells its own event. prefix), and decision 6 gives the one total function from the document to the declared-path set.

This module is that record's reader. index/1 admits a decoded document and flattens it to path -> entry, at every nesting depth; the lookups answer what a path's type is, what lies under a prefix, and whether a path is declared at all; declared_paths/1 is decision 6's projection.

Advisory, never a gate

Decision 9 is the stance this module is built to keep: an undeclared path is unknown, not wrong. Nothing here returns a verdict, produces a StatifierBlocks.Finding, or refuses anything. declared?/2 answers a question about the document, not about the author, and type/2 returns nil for a path the document does not declare rather than an error - absence of a declaration is not a claim that the path is bad.

Making an undeclared path a validation failure needs a record saying so, which is what sb-oiq asked for from the start and what decision 9 granted. Two consumers already read a datamodel and neither gates on declaredness: StatifierBlocks.Datamodel reports :info (ADR-0005 11e), and StatifierBlocks.Compiler.SensitivePaths refuses only on the separate sensitive? claim, which is a claim the host made rather than one this package inferred.

The admission step is index/1

Decision 6 states its totality "over admitted documents: a malformed input is a loader concern, rejected before this function is reached, which is why the function has no {:error, _} arm to explain". index/1 is that loader. It is itself total - an input it cannot admit returns nil, on ADR-0002 amendment B3's total-normalizer discipline, the same way StatifierBlocks.Datamodel.declared_paths/1 treats a shape it does not know - and every function taking a t/0 is then total by construction.

So the record's declared_paths(document) is spelled here as

document |> index() |> declared_paths()

with the nil case being this input is not a datamodel document, which is a different thing from the document declares nothing. That distinction is decision 6's, stated there for exactly the same pair of values: nil is no datamodel supplied, MapSet.new() is a host claim that nothing is declared.

What normalization does, and what it declines to decide

Keys are read as the record writes them, from a decoded JSON map with string keys.

• Scope names contribute nothing to a path (decision 6), so a scope map naming something other than the three is not rejected: its entries are indexed with scope: nil. Paths are already absolute, and dropping entries over a scope label would lose declared paths the projection is required to contain.
• An entry whose path is not a non-empty string contributes no path, and its fields are still walked. That is the only place this module departs from decision 6's literal code, which would put a nil in the set; a set with a nil in it is not a set of declared paths, and the record admits no such entry in the first place.
• The type set is closed (decision 4). A type or item_type outside the eight normalizes to nil - unknown, on the same stance as an undeclared path - rather than being carried through as a ninth type this package would then be rendering.
• A repeated path keeps its first occurrence in document order. This is not a ruling on the record's open question about collisions across scopes: the declared-path set is a set either way, and a document that needs the question answered needs a loader lint, which is where the record leaves it.
• name is read and stored, and nothing here consumes it. The record carries an open question on how an event entry spells it; this module reads path alone for every derivation, exactly as decision 6 does, so the question stays open rather than being answered by use.

sensitive?, and why it is derived here rather than projected

ADR-0006 decision 7 says the entry map is where a per-path annotation lives, in ADR-0002's optional-boolean convention, and that decision 6's projection deliberately drops it: "a consumer that needs to know whether a path is sensitive reads the document, never the set". ADR-0002's accepted sensitive? amendment says the same from the other side - if the document record lands, "the same boolean belongs on its per-entry shape".

sensitive_paths/1 is that read, and it is a second projection rather than a widening of the first: declared_paths/1 returns paths and nothing else, exactly as decision 6 specifies. datamodel/1 pairs the two into the %{declared: MapSet, sensitive: MapSet} shape StatifierBlocks.Compiler.SensitivePaths.datamodel/1 already normalizes, so a host with a document can reach that pass without a second input.

An entry's flag is read literally, per entry. An object entry marked sensitive does not stamp its fields, and does not need to: the sensitive-path matcher already treats a read of a prefix as a read of everything under it ("a prefix read is the same leak spelled shorter"), so inheritance here would restate the matcher and, where the two disagreed, would decide a rule no record has drawn.

Not wired to anything

This module has no consumer in this package, on purpose. sb-oiq filed itself as "file this when something actually needs a path/type index", and what needs it today is the derivation the accepted record promised - not a fixtures or completion pane, which ADR-0005 decision 15 lists among the things that record explicitly does not decide. The one seam taken is the additive StatifierBlocks.Datamodel.declared_paths/1 clause, which discharges 11f's promise for a host that has a document instead of a set.