Extract Type::truncateListToSize() from TypeSpecifier

`specifyTypesForCountFuncCall` had ~100 lines of inline shape-specific
narrowing (rebuild as N-element list, build with required prefix +
optional middle, probe `hasOffsetValueType` for unbounded max,
intersect with `HasOffsetValueType` accessories for non-CAT lists,
plus several `LIMIT` bail-outs that returned the original array). The
five branches were interleaved with the same outer `count()`-call /
size-superType filters, making the per-shape logic hard to read.

Push the per-list rebuild into a new `Type::truncateListToSize(Type
$sizeType): Type`:

  - `ConstantArrayType`: required prefix `[0, min)`, optional middle
    `[min, max)` when `max` is set, or probe explicit offsets via
    `hasOffsetValueType` until `no` when `max` is unbounded.

  - `ArrayType`: same prefix/middle for bounded ranges; for unbounded
    `max`, intersect with `HasOffsetValueType` accessories.

  - Non-array types (`NonArrayTypeTrait`, `MaybeArrayTypeTrait`): return
    `ErrorType`.

  - `LateResolvableTypeTrait`: delegate to the resolved type.

  - `UnionType` / `IntersectionType` / `StaticType`: dispatch.

  - `NeverType` / `MixedType` / accessory types: identity-ish — the
    accessories represent metadata orthogonal to size, so the narrowing
    flows through `IntersectionType`'s dispatcher unchanged.

The method is named for its actual contract: each implementation
assumes a list shape. The call site (`TypeSpecifier`) is responsible
for gating on outer list-ness — a CAT inside a `non-empty-list<T>`
intersection may have its own `isList()` weakened to `Maybe` even
though the aggregate is definitely a list. Letting the call site
decide preserves the original behavior exactly.

A private static helper `ConstantArrayType::extractTruncateListBounds()`
peels `[min, max]` out of either a `ConstantIntegerType` (`[N, N]`) or
an `IntegerRangeType`, sparing both implementations the same two-line
shape check.

Behavior preserved: full test suite green.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ondrejmirtes

src/Analyser/TypeSpecifier.php

@@ -49,7 +49,6 @@
 use PHPStan\Type\BooleanType;
 use PHPStan\Type\ConditionalTypeForParameter;
 use PHPStan\Type\Constant\ConstantArrayType;
-use PHPStan\Type\Constant\ConstantArrayTypeBuilder;
 use PHPStan\Type\Constant\ConstantBooleanType;
 use PHPStan\Type\Constant\ConstantFloatType;
 use PHPStan\Type\Constant\ConstantIntegerType;
@@ -100,8 +99,6 @@
 final class TypeSpecifier
 {
 
-	private const MAX_ACCESSORIES_LIMIT = 8;
-
 	private const BOOLEAN_EXPRESSION_MAX_PROCESS_DEPTH = 4;
 
 	/** @var MethodTypeSpecifyingExtension[][]|null */
@@ -1432,100 +1429,15 @@ private function specifyTypesForCountFuncCall(
 				continue;
 			}
 
-			if (
-				$sizeType instanceof ConstantIntegerType
-				&& $sizeType->getValue() < ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT
-				&& $isList->yes()
-				&& $arrayType->getKeyType()->isSuperTypeOf(IntegerRangeType::fromInterval(0, $sizeType->getValue() - 1))->yes()
-			) {
-				// turn optional offsets non-optional
-				$valueTypesBuilder = ConstantArrayTypeBuilder::createEmpty();
-				for ($i = 0; $i < $sizeType->getValue(); $i++) {
-					$offsetType = new ConstantIntegerType($i);
-					$valueTypesBuilder->setOffsetValueType($offsetType, $arrayType->getOffsetValueType($offsetType));
-				}
-				$resultTypes[] = $valueTypesBuilder->getArray();
-				continue;
-			}
-
-			if (
-				$sizeType instanceof IntegerRangeType
-				&& $sizeType->getMin() !== null
-				&& $sizeType->getMin() < ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT
-				&& $isList->yes()
-				&& $arrayType->getKeyType()->isSuperTypeOf(IntegerRangeType::fromInterval(0, ($sizeType->getMax() ?? $sizeType->getMin()) - 1))->yes()
-			) {
-				$builderData = [];
-				// turn optional offsets non-optional
-				for ($i = 0; $i < $sizeType->getMin(); $i++) {
-					$offsetType = new ConstantIntegerType($i);
-					$builderData[] = [$offsetType, $arrayType->getOffsetValueType($offsetType), false];
-				}
-				if ($sizeType->getMax() !== null) {
-					if ($sizeType->getMax() - $sizeType->getMin() > ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT) {
-						$resultTypes[] = $arrayType;
-						continue;
-					}
-					for ($i = $sizeType->getMin(); $i < $sizeType->getMax(); $i++) {
-						$offsetType = new ConstantIntegerType($i);
-						$builderData[] = [$offsetType, $arrayType->getOffsetValueType($offsetType), true];
-					}
-				} elseif ($arrayType->isConstantArray()->yes()) {
-					for ($i = $sizeType->getMin();; $i++) {
-						$offsetType = new ConstantIntegerType($i);
-						$hasOffset = $arrayType->hasOffsetValueType($offsetType);
-						if ($hasOffset->no()) {
-							break;
-						}
-						$builderData[] = [$offsetType, $arrayType->getOffsetValueType($offsetType), !$hasOffset->yes()];
-					}
-				} else {
-					$intersection = [];
-					$intersection[] = $arrayType;
-					$intersection[] = new NonEmptyArrayType();
-
-					$zero = new ConstantIntegerType(0);
-					$i = 0;
-					foreach ($builderData as [$offsetType, $valueType]) {
-						// non-empty-list already implies the offset 0
-						if ($zero->isSuperTypeOf($offsetType)->yes()) {
-							continue;
-						}
-
-						if ($i > self::MAX_ACCESSORIES_LIMIT) {
-							break;
-						}
-
-						$intersection[] = new HasOffsetValueType($offsetType, $valueType);
-						$i++;
-					}
-
-					$resultTypes[] = TypeCombinator::intersect(...$intersection);
-					continue;
-				}
-
-				if (count($builderData) > ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT) {
-					$resultTypes[] = $arrayType;
-					continue;
-				}
-
-				$builder = ConstantArrayTypeBuilder::createEmpty();
-				foreach ($builderData as [$offsetType, $valueType, $optional]) {
-					$builder->setOffsetValueType($offsetType, $valueType, $optional);
-				}
-
-				$builtArray = $builder->getArray();
-				if ($isList->yes() && !$builder->isList()) {
-					$constantArrays = $builtArray->getConstantArrays();
-					if (count($constantArrays) === 1) {
-						$builtArray = $constantArrays[0]->makeList();
-					}
-				}
-				$resultTypes[] = $builtArray;
-				continue;
-			}
-
-			$resultTypes[] = TypeCombinator::intersect($arrayType, new NonEmptyArrayType());
+			// `truncateListToSize` rebuilds the inner array as a list shape
+			// — that's only sound when the *outer* type is definitely a
+			// list. The inner array alone may have `isList()` answer `Maybe`
+			// (e.g. `ArrayType<int<0, max>, T>` inside a
+			// `non-empty-list<T>` intersection), so the gate has to live
+			// here, not on the per-array method.
+			$resultTypes[] = $isList->yes()
+				? $arrayType->truncateListToSize($sizeType)
+				: TypeCombinator::intersect($arrayType, new NonEmptyArrayType());
 		}
 
 		if ($context->truthy() && $isConstantArray->yes() && $isList->yes()) {

src/Type/Accessory/AccessoryArrayListType.php

@@ -261,6 +261,13 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return $this;
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		// List-ness survives a count narrowing — the resulting array is
+		// still a list, just of a constrained size.
+		return $this;
+	}
+
 	public function makeListMaybe(): Type
 	{
 		// This accessory is the list assertion itself; weakening the

src/Type/Accessory/HasOffsetType.php

@@ -225,6 +225,12 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return new MixedType();
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		// Having a specific offset is independent of the array's size bound.
+		return $this;
+	}
+
 	public function makeListMaybe(): Type
 	{
 		// Having an offset doesn't conflict with list-being-maybe.

src/Type/Accessory/HasOffsetValueType.php

@@ -314,6 +314,13 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return new MixedType();
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		// `HasOffsetValueType` is metadata about a specific key — independent
+		// of the array's overall size constraint.
+		return $this;
+	}
+
 	public function makeListMaybe(): Type
 	{
 		// Knowing a specific offset/value is independent of list-ness.

src/Type/Accessory/NonEmptyArrayType.php

@@ -248,6 +248,13 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return new MixedType();
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		// The accessory only asserts "this array is non-empty" — truncating
+		// to a positive size leaves that property in place.
+		return $this;
+	}
+
 	public function makeListMaybe(): Type
 	{
 		// Non-emptiness is independent of list-ness; weaken-list keeps it.

src/Type/Accessory/OversizedArrayType.php

@@ -225,6 +225,11 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return $this;
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		return $this;
+	}
+
 	public function makeListMaybe(): Type
 	{
 		return $this;

src/Type/ArrayType.php

@@ -55,6 +55,8 @@ class ArrayType implements Type
 	use UndecidedComparisonTypeTrait;
 	use NonGeneralizableTypeTrait;
 
+	private const TRUNCATE_ACCESSORIES_LIMIT = 8;
+
 	private Type $keyType;
 
 	private ?TrinaryLogic $isList = null;
@@ -589,6 +591,74 @@ public function makeListMaybe(): Type
 		return $this;
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		[$min, $max] = ConstantArrayType::extractTruncateListBounds($sizeType);
+
+		// `isList()` is deliberately NOT checked here — see the matching
+		// note on `ConstantArrayType::truncateListToSize`. The call site
+		// has already established outer list-ness.
+		if (
+			$min === null
+			|| $min >= ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT
+			|| !$this->getKeyType()->isSuperTypeOf(IntegerRangeType::fromInterval(0, ($max ?? $min) - 1))->yes()
+		) {
+			return TypeCombinator::intersect($this, new NonEmptyArrayType());
+		}
+
+		if ($max !== null) {
+			// Bounded range — `ArrayType` doesn't carry per-offset types, so
+			// rebuild via the same CAT builder logic as `ConstantArrayType`.
+			// The values come from `$this->getOffsetValueType()` (which on a
+			// general `ArrayType` collapses to the iterable value type).
+			if ($max - $min > ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT) {
+				return TypeCombinator::intersect($this, new NonEmptyArrayType());
+			}
+
+			$builder = ConstantArrayTypeBuilder::createEmpty();
+			for ($i = 0; $i < $min; $i++) {
+				$offsetType = new ConstantIntegerType($i);
+				$builder->setOffsetValueType($offsetType, $this->getOffsetValueType($offsetType), false);
+			}
+			for ($i = $min; $i < $max; $i++) {
+				$offsetType = new ConstantIntegerType($i);
+				$builder->setOffsetValueType($offsetType, $this->getOffsetValueType($offsetType), true);
+			}
+
+			$builtArray = $builder->getArray();
+			if (!$builder->isList()) {
+				$constantArrays = $builtArray->getConstantArrays();
+				if (count($constantArrays) === 1) {
+					$builtArray = $constantArrays[0]->makeList();
+				}
+			}
+
+			return $builtArray;
+		}
+
+		// Unbounded max on a general `ArrayType` list: we can't enumerate the
+		// trailing entries, so anchor the lower bound with
+		// `HasOffsetValueType` accessories (skipping offset 0 — already
+		// implied by `NonEmptyArrayType`).
+		$intersection = [$this, new NonEmptyArrayType()];
+		$zero = new ConstantIntegerType(0);
+		$added = 0;
+		for ($i = 0; $i < $min; $i++) {
+			$offsetType = new ConstantIntegerType($i);
+			if ($zero->isSuperTypeOf($offsetType)->yes()) {
+				continue;
+			}
+			if ($added > self::TRUNCATE_ACCESSORIES_LIMIT) {
+				break;
+			}
+
+			$intersection[] = new HasOffsetValueType($offsetType, $this->getOffsetValueType($offsetType));
+			$added++;
+		}
+
+		return TypeCombinator::intersect(...$intersection);
+	}
+
 	public function mapValueType(callable $cb): Type
 	{
 		return $this->withTypes($this->keyType, $cb($this->getItemType()));

src/Type/Constant/ConstantArrayType.php

@@ -1292,6 +1292,99 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return TypeCombinator::union(...$types);
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		[$min, $max] = self::extractTruncateListBounds($sizeType);
+
+		// `getMin() === null` ↔ unbounded below; the narrowing has no anchor
+		// to start from. Also bail out when the required prefix would exceed
+		// the array-shape limit — we can't enumerate that many keys.
+		// `isList()` is intentionally NOT checked here: the call site
+		// (`TypeSpecifier`) only invokes this when the *outer* aggregate is
+		// already a list, but a CAT inside a `non-empty-list` intersection
+		// may have its own `isList()` weakened to `Maybe`.
+		if (
+			$min === null
+			|| $min >= ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT
+			|| !$this->getKeyType()->isSuperTypeOf(IntegerRangeType::fromInterval(0, ($max ?? $min) - 1))->yes()
+		) {
+			return TypeCombinator::intersect($this, new NonEmptyArrayType());
+		}
+
+		// Required prefix `[0, $min)`: every value definitely present.
+		$builderData = [];
+		for ($i = 0; $i < $min; $i++) {
+			$offsetType = new ConstantIntegerType($i);
+			$builderData[] = [$offsetType, $this->getOffsetValueType($offsetType), false];
+		}
+
+		if ($max !== null) {
+			// Optional middle `[$min, $max)`.
+			if ($max - $min > ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT) {
+				return TypeCombinator::intersect($this, new NonEmptyArrayType());
+			}
+			for ($i = $min; $i < $max; $i++) {
+				$offsetType = new ConstantIntegerType($i);
+				$builderData[] = [$offsetType, $this->getOffsetValueType($offsetType), true];
+			}
+		} else {
+			// Unbounded max: probe explicit keys from `$min` onward until
+			// `hasOffsetValueType` answers `no`. Each probe contributes one
+			// optional (or required, when `hasOffsetValueType` is `yes`) slot.
+			for ($i = $min;; $i++) {
+				$offsetType = new ConstantIntegerType($i);
+				$hasOffset = $this->hasOffsetValueType($offsetType);
+				if ($hasOffset->no()) {
+					break;
+				}
+				$builderData[] = [$offsetType, $this->getOffsetValueType($offsetType), !$hasOffset->yes()];
+			}
+		}
+
+		if (count($builderData) > ConstantArrayTypeBuilder::ARRAY_COUNT_LIMIT) {
+			return TypeCombinator::intersect($this, new NonEmptyArrayType());
+		}
+
+		$builder = ConstantArrayTypeBuilder::createEmpty();
+		foreach ($builderData as [$offsetType, $valueType, $optional]) {
+			$builder->setOffsetValueType($offsetType, $valueType, $optional);
+		}
+
+		$builtArray = $builder->getArray();
+		// `setOffsetValueType` on a brand-new builder produces a list when
+		// the resulting offsets are sequential ints — but it may not preserve
+		// list-ness in every shape. Reattach it for the single-CAT case.
+		if (!$builder->isList()) {
+			$constantArrays = $builtArray->getConstantArrays();
+			if (count($constantArrays) === 1) {
+				$builtArray = $constantArrays[0]->makeList();
+			}
+		}
+
+		return $builtArray;
+	}
+
+	/**
+	 * Extracts (min, max) bounds from a size type for `truncateListToSize`.
+	 * `ConstantIntegerType(N)` → `[N, N]`. `IntegerRangeType` →
+	 * `[$min, $max]`. Anything else returns `[null, null]` and the caller
+	 * falls back to the non-precise path.
+	 *
+	 * @return array{?int, ?int}
+	 */
+	public static function extractTruncateListBounds(Type $sizeType): array
+	{
+		if ($sizeType instanceof ConstantIntegerType) {
+			return [$sizeType->getValue(), $sizeType->getValue()];
+		}
+
+		if ($sizeType instanceof IntegerRangeType) {
+			return [$sizeType->getMin(), $sizeType->getMax()];
+		}
+
+		return [null, null];
+	}
+
 	public function isIterableAtLeastOnce(): TrinaryLogic
 	{
 		$keysCount = count($this->keyTypes);

src/Type/IntersectionType.php

@@ -1228,6 +1228,11 @@ public function spliceArray(Type $offsetType, Type $lengthType, Type $replacemen
 		return $this->intersectTypesPreserveTemplateType(static fn (Type $type): Type => $type->spliceArray($offsetType, $lengthType, $replacementType));
 	}
 
+	public function truncateListToSize(Type $sizeType): Type
+	{
+		return $this->intersectTypesPreserveTemplateType(static fn (Type $type): Type => $type->truncateListToSize($sizeType));
+	}
+
 	public function makeListMaybe(): Type
 	{
 		return $this->intersectTypes(static fn (Type $type): Type => $type->makeListMaybe());