@nifrajs/cli 3.2.0 → 3.5.0

package/src/mcp-render.ts

@@ -15,6 +15,13 @@ import { type AppLike, runApp } from "@nifrajs/runner"
 import { createWebApp, type RenderAdapter } from "@nifrajs/web"
 import { discoverRoutes } from "@nifrajs/web/fs"
 import { loadApp, resolvePlugins } from "./load.ts"
+import {
+  CHILD_INPUT_MAX_BYTES,
+  CHILD_OUTPUT_MAX_BYTES,
+  readBoundedLines,
+  readBoundedStream,
+  serializeBoundedJson,
+} from "./mcp-io.ts"
 
 const errString = (err: unknown): string =>
   err instanceof Error ? `${err.name}: ${err.message}` : String(err)
@@ -89,6 +96,12 @@ function redirectConsoleToStderr(): void {
   console.error = (...args: unknown[]) => write("error", args)
 }
 
+function safeResponseId(value: unknown): number | string | null {
+  if (typeof value === "number" && Number.isSafeInteger(value)) return value
+  if (typeof value === "string" && value.length <= 128) return value
+  return null
+}
+
 /**
  * Warm-worker loop (`--worker`): build the web app ONCE, then SSR each `{ id, input: { requests } }` line
  * against that hot app and reply `{ id, output }`. The parent (`mcp.ts`'s warm-render handler) spawns this,
@@ -100,43 +113,51 @@ async function runWorker(cwd: string): Promise<void> {
   // Build once; the same `{ error }` is returned for every request if the build failed, so an agent sees
   // the actionable message and the parent restarts the worker on the next file change.
   const built = await buildWebApp(cwd)
-  const decoder = new TextDecoder()
-  let buffer = ""
   const send = (id: unknown, output: unknown): void => {
-    process.stdout.write(`${JSON.stringify({ id, output })}\n`)
+    const responseId = safeResponseId(id)
+    const encoded = serializeBoundedJson({ id: responseId, output }, CHILD_OUTPUT_MAX_BYTES - 1)
+    process.stdout.write(
+      `${encoded ?? JSON.stringify({ id: responseId, output: { error: "worker output exceeded the size limit" } })}\n`,
+    )
   }
-  for await (const chunk of Bun.stdin.stream()) {
-    buffer += decoder.decode(chunk as Uint8Array, { stream: true })
-    let nl = buffer.indexOf("\n")
-    while (nl !== -1) {
-      const line = buffer.slice(0, nl).trim()
-      buffer = buffer.slice(nl + 1)
-      nl = buffer.indexOf("\n")
-      if (line === "") continue
+  for await (const item of readBoundedLines(Bun.stdin.stream(), CHILD_INPUT_MAX_BYTES)) {
+    if (item.kind === "too-large") {
+      send(null, { error: `worker input exceeded ${CHILD_INPUT_MAX_BYTES} bytes` })
+      continue
+    }
+    const line = item.text.trim()
+    if (line === "") continue
 
-      let message: RenderWorkerMessage
-      try {
-        message = JSON.parse(line) as RenderWorkerMessage
-      } catch {
-        send(null, { error: "invalid worker input: expected JSON line" })
-        continue
-      }
-      const requests = message.input?.requests
-      if (!Array.isArray(requests)) {
-        send(message.id, { error: "expected { requests: [...] }" })
-        continue
-      }
-      if ("error" in built) {
-        send(message.id, built)
-        continue
-      }
-      try {
-        send(message.id, {
-          results: await runApp(built.app, requests as Parameters<typeof runApp>[1]),
-        })
-      } catch (err) {
-        send(message.id, { error: errString(err) })
-      }
+    let message: unknown
+    try {
+      message = JSON.parse(line) as unknown
+    } catch {
+      send(null, { error: "invalid worker input: expected JSON line" })
+      continue
+    }
+    const record =
+      message !== null && typeof message === "object" && !Array.isArray(message)
+        ? (message as RenderWorkerMessage)
+        : undefined
+    const input =
+      record?.input !== null && typeof record?.input === "object" && !Array.isArray(record.input)
+        ? record.input
+        : undefined
+    const requests = input?.requests
+    if (!Array.isArray(requests)) {
+      send(record?.id, { error: "expected { requests: [...] }" })
+      continue
+    }
+    if ("error" in built) {
+      send(record?.id, built)
+      continue
+    }
+    try {
+      send(record?.id, {
+        results: await runApp(built.app, requests as Parameters<typeof runApp>[1]),
+      })
+    } catch (err) {
+      send(record?.id, { error: errString(err) })
     }
   }
 }
@@ -163,13 +184,22 @@ if (import.meta.main) {
     process.exit(0)
   }
   let output: unknown
-  try {
-    const { requests } = JSON.parse(await Bun.stdin.text()) as { requests: unknown }
-    output = await renderPages(cwd, requests)
-  } catch {
-    output = { error: "invalid input: expected JSON { requests: [...] }" }
+  const input = await readBoundedStream(Bun.stdin.stream(), CHILD_INPUT_MAX_BYTES)
+  if (input.truncated) {
+    output = { error: `input exceeded ${CHILD_INPUT_MAX_BYTES} bytes` }
+  } else {
+    try {
+      const { requests } = JSON.parse(input.text) as { requests: unknown }
+      output = await renderPages(cwd, requests)
+    } catch {
+      output = { error: "invalid input: expected JSON { requests: [...] }" }
+    }
   }
-  await Bun.write(Bun.stdout, JSON.stringify(output, null, 2))
+  await Bun.write(
+    Bun.stdout,
+    serializeBoundedJson(output, CHILD_OUTPUT_MAX_BYTES, 2) ??
+      JSON.stringify({ error: `output exceeded ${CHILD_OUTPUT_MAX_BYTES} bytes` }),
+  )
   // Exit explicitly, exactly as the `--worker` branch above already does.
   //
   // Loading the app runs its module side effects, and a real app opens things: a database pool, a

package/src/mcp-root.ts

@@ -33,6 +33,10 @@ export interface McpRootState {
   readonly clientRoots: readonly string[] | null
 }
 
+const MAX_CLIENT_ROOTS = 64
+const MAX_ROOT_URI_LENGTH = 16_384
+const MAX_ROOT_PATH_LENGTH = 4_096
+
 /** A directory is a nifra project when its `package.json` depends on any `@nifrajs/*` package, or it
  * is a `nifra.config.ts` monorepo root. Backend-only projects (no web config, no `routes/`) count -
  * the marker is the dependency, not the app shape. */
@@ -98,9 +102,12 @@ export function pathsFromRootsResult(result: unknown): string[] {
   const roots = (result as { roots?: unknown }).roots
   if (!Array.isArray(roots)) return []
   const paths: string[] = []
+  const seen = new Set<string>()
   for (const entry of roots) {
+    if (paths.length >= MAX_CLIENT_ROOTS) break
     const uri = (entry as { uri?: unknown })?.uri
-    if (typeof uri !== "string" || !uri.startsWith("file://")) continue
+    if (typeof uri !== "string" || uri.length > MAX_ROOT_URI_LENGTH || !uri.startsWith("file://"))
+      continue
     try {
       const parsed = new URL(uri)
       // A remote file host is a UNC path on Windows, not a local workspace root. MCP roots are
@@ -111,7 +118,11 @@ export function pathsFromRootsResult(result: unknown): string[] {
         (parsed.hostname !== "" && parsed.hostname !== "localhost")
       )
         continue
-      paths.push(fileURLToPath(parsed))
+      const path = fileURLToPath(parsed)
+      if (path.length === 0 || path.length > MAX_ROOT_PATH_LENGTH || path.includes("\0")) continue
+      if (seen.has(path)) continue
+      seen.add(path)
+      paths.push(path)
     } catch {
       // Malformed URI - skip.
     }

package/src/mcp-run.ts

@@ -9,6 +9,13 @@ import { existsSync, realpathSync } from "node:fs"
 import { isAbsolute, relative, resolve, sep } from "node:path"
 import { pathToFileURL } from "node:url"
 import { type AppLike, runApp } from "@nifrajs/runner"
+import {
+  CHILD_INPUT_MAX_BYTES,
+  CHILD_OUTPUT_MAX_BYTES,
+  readBoundedLines,
+  readBoundedStream,
+  serializeBoundedJson,
+} from "./mcp-io.ts"
 
 const ENTRY_CANDIDATES = ["backend.ts", "app.ts", "src/backend.ts", "src/app.ts"]
 
@@ -100,54 +107,79 @@ function redirectConsoleToStderr(): void {
   console.error = (...args: unknown[]) => write("error", args)
 }
 
+function safeResponseId(value: unknown): number | string | null {
+  if (typeof value === "number" && Number.isSafeInteger(value)) return value
+  if (typeof value === "string" && value.length <= 128) return value
+  return null
+}
+
 async function runWorker(cwd: string): Promise<void> {
   redirectConsoleToStderr()
   const apps = new Map<string, Promise<{ app: AppLike } | { error: string }>>()
-  const decoder = new TextDecoder()
-  let buffer = ""
   const send = (id: unknown, output: unknown): void => {
-    process.stdout.write(`${JSON.stringify({ id, output })}\n`)
+    const responseId = safeResponseId(id)
+    const encoded = serializeBoundedJson({ id: responseId, output }, CHILD_OUTPUT_MAX_BYTES - 1)
+    process.stdout.write(
+      `${encoded ?? JSON.stringify({ id: responseId, output: { error: "worker output exceeded the size limit" } })}\n`,
+    )
   }
-  for await (const chunk of Bun.stdin.stream()) {
-    buffer += decoder.decode(chunk as Uint8Array, { stream: true })
-    let nl = buffer.indexOf("\n")
-    while (nl !== -1) {
-      const line = buffer.slice(0, nl).trim()
-      buffer = buffer.slice(nl + 1)
-      nl = buffer.indexOf("\n")
-      if (line === "") continue
+  for await (const item of readBoundedLines(Bun.stdin.stream(), CHILD_INPUT_MAX_BYTES)) {
+    if (item.kind === "too-large") {
+      send(null, { error: `worker input exceeded ${CHILD_INPUT_MAX_BYTES} bytes` })
+      continue
+    }
+    const line = item.text.trim()
+    if (line === "") continue
 
-      let message: WorkerMessage
-      try {
-        message = JSON.parse(line) as WorkerMessage
-      } catch {
-        send(null, { error: "invalid worker input: expected JSON line" })
-        continue
-      }
-      const requests = message.input?.requests
-      const entry = message.input?.entry
-      if (!Array.isArray(requests)) {
-        send(message.id, { error: "expected { requests: [...] }" })
-        continue
-      }
-      const key = entry ?? ""
-      let loaded = apps.get(key)
-      if (loaded === undefined) {
-        loaded = loadBackend(cwd, entry)
-        apps.set(key, loaded)
-      }
-      const app = await loaded
-      if ("error" in app) {
-        send(message.id, app)
-        continue
-      }
-      try {
-        send(message.id, {
-          results: await runApp(app.app, requests as Parameters<typeof runApp>[1]),
-        })
-      } catch (err) {
-        send(message.id, { error: errString(err) })
-      }
+    let message: unknown
+    try {
+      message = JSON.parse(line) as unknown
+    } catch {
+      send(null, { error: "invalid worker input: expected JSON line" })
+      continue
+    }
+    const record =
+      message !== null && typeof message === "object" && !Array.isArray(message)
+        ? (message as WorkerMessage)
+        : undefined
+    const input =
+      record?.input !== null && typeof record?.input === "object" && !Array.isArray(record.input)
+        ? record.input
+        : undefined
+    const id = record?.id
+    const requests = input?.requests
+    const entry = input?.entry
+    if (!Array.isArray(requests)) {
+      send(id, { error: "expected { requests: [...] }" })
+      continue
+    }
+    if (entry !== undefined && typeof entry !== "string") {
+      send(id, { error: "entry must be a string" })
+      continue
+    }
+    const key = entry ?? ""
+    let loaded = apps.get(key)
+    if (loaded === undefined) {
+      loaded = loadBackend(cwd, entry)
+      apps.set(key, loaded)
+    }
+    let app: Awaited<typeof loaded>
+    try {
+      app = await loaded
+    } catch (err) {
+      send(id, { error: errString(err) })
+      continue
+    }
+    if ("error" in app) {
+      send(id, app)
+      continue
+    }
+    try {
+      send(id, {
+        results: await runApp(app.app, requests as Parameters<typeof runApp>[1]),
+      })
+    } catch (err) {
+      send(id, { error: errString(err) })
     }
   }
 }
@@ -161,14 +193,22 @@ if (import.meta.main) {
     process.exit(0)
   }
   let output: unknown
-  try {
-    const { requests, entry } = JSON.parse(await Bun.stdin.text()) as {
-      requests: unknown
-      entry?: string
+  const input = await readBoundedStream(Bun.stdin.stream(), CHILD_INPUT_MAX_BYTES)
+  if (input.truncated) {
+    output = { error: `input exceeded ${CHILD_INPUT_MAX_BYTES} bytes` }
+  } else {
+    try {
+      const { requests, entry } = JSON.parse(input.text) as {
+        requests: unknown
+        entry?: string
+      }
+      output = await runBackend(cwd, requests, entry)
+    } catch {
+      output = { error: "invalid input: expected JSON { requests: [...] }" }
     }
-    output = await runBackend(cwd, requests, entry)
-  } catch {
-    output = { error: "invalid input: expected JSON { requests: [...] }" }
   }
-  process.stdout.write(JSON.stringify(output, null, 2))
+  process.stdout.write(
+    serializeBoundedJson(output, CHILD_OUTPUT_MAX_BYTES, 2) ??
+      JSON.stringify({ error: `output exceeded ${CHILD_OUTPUT_MAX_BYTES} bytes` }),
+  )
 }

package/src/mcp.ts

@@ -45,6 +45,8 @@ import { docsTools } from "./mcp-docs-tools.ts"
 import {
   createMcpProtocolState,
   handleRpc,
+  isJsonRpcRequest,
+  isJsonRpcResponse,
   type JsonRpcNotification,
   type JsonRpcRequest,
   type JsonRpcResponse,
@@ -80,15 +82,18 @@ import {
   type ToolingDrift,
 } from "./mcp-root.ts"
 
-export type { BoundedOutput } from "./mcp-io.ts"
+export type { BoundedLine, BoundedOutput } from "./mcp-io.ts"
 export {
+  CHILD_INPUT_MAX_BYTES,
   CHILD_OUTPUT_MAX_BYTES,
   CHILD_TIMEOUT_MS,
   LOCAL_TOOL_FETCH_TIMEOUT_MS,
   LOCAL_TOOL_MAX_RESPONSE_BYTES,
   notNifraResponse,
+  readBoundedLines,
   readBoundedResponse,
   readBoundedStream,
+  serializeBoundedJson,
   timeoutMessage,
   validateLocalPort,
 } from "./mcp-io.ts"
@@ -155,6 +160,8 @@ async function appDeclaredTools(loader: () => Promise<LoadedApp>): Promise<McpTo
 }
 
 const ROOTS_REQUEST_ID = "nifra:roots/list"
+const MAX_STDIO_MESSAGE_BYTES = 8 * 1024 * 1024
+const STDIO_ENCODER = new TextEncoder()
 
 /** Everything derived from the project root - rebuilt wholesale when the root changes (adoption of a
  * client workspace root), so no per-tool state can keep pointing at the old directory. */
@@ -215,17 +222,31 @@ export async function runMcpServer(
   const serverInfo = { name: "nifra", version }
   const state = createMcpProtocolState()
   const send = (message: JsonRpcResponse | JsonRpcNotification): void => {
-    process.stdout.write(`${JSON.stringify(message)}\n`)
+    let encoded: string
+    try {
+      encoded = JSON.stringify(message)
+    } catch {
+      encoded = JSON.stringify(
+        rpcError(responseIdOf(message), -32603, "MCP response is not serializable"),
+      )
+    }
+    if (STDIO_ENCODER.encode(encoded).byteLength > MAX_STDIO_MESSAGE_BYTES)
+      encoded = JSON.stringify(
+        rpcError(responseIdOf(message), -32603, "MCP response exceeded the size limit"),
+      )
+    process.stdout.write(`${encoded}\n`)
   }
   let rootsSupported = false
+  let rootsRequestPending = false
   const requestRoots = (): void => {
-    if (!rootsSupported) return
+    if (!rootsSupported || rootsRequestPending) return
+    rootsRequestPending = true
     process.stdout.write(
       `${JSON.stringify({ jsonrpc: "2.0", id: ROOTS_REQUEST_ID, method: "roots/list" })}\n`,
     )
   }
-  const onRootsAnswer = async (message: JsonRpcRequest): Promise<void> => {
-    const result = (message as { result?: unknown }).result
+  const onRootsAnswer = async (message: JsonRpcResponse): Promise<void> => {
+    const result = "result" in message ? message.result : undefined
     // An error response (or a malformed one) carries no roots: keep the current state - the absence
     // of workspace data is not a mismatch, and never a reason to move the root.
     if (result === undefined) return
@@ -241,15 +262,15 @@ export async function runMcpServer(
   // must see the adopted root, even though dispatches themselves run concurrently.
   let rootsUpdate: Promise<void> = Promise.resolve()
 
+  const dispatchRootsAnswer = (message: JsonRpcResponse): void => {
+    // The roots answer is a response to a request initiated by this server, not a client RPC request.
+    // Serialize adoption with normal dispatch so a following request cannot observe a half-updated root.
+    if (!rootsRequestPending) return
+    rootsRequestPending = false
+    rootsUpdate = onRootsAnswer(message).catch(() => {})
+  }
+
   const dispatch = async (message: JsonRpcRequest): Promise<void> => {
-    // The client's answer to OUR `roots/list` request - a response (id, no method), which the pure
-    // dispatch would reject as an unknown method. Intercept it before handleRpc ever sees it.
-    if (message.method === undefined && message.id === ROOTS_REQUEST_ID) {
-      // Swallow failures: a bad answer must not poison the chain and 500 every later dispatch.
-      rootsUpdate = onRootsAnswer(message).catch(() => {})
-      await rootsUpdate
-      return
-    }
     await rootsUpdate
     if (message.method === "initialize") {
       rootsSupported = clientSupportsRoots(message.params)
@@ -301,25 +322,64 @@ export async function runMcpServer(
 
   const decoder = new TextDecoder()
   let buffer = ""
+  let bufferBytes = 0
+  let discardingOversized = false
+  const processLine = (rawLine: string): void => {
+    const line = rawLine.trim()
+    if (line === "") return
+    if (STDIO_ENCODER.encode(rawLine).byteLength > MAX_STDIO_MESSAGE_BYTES) {
+      send(rpcError(null, -32600, "MCP message exceeded the size limit"))
+      return
+    }
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(line) as unknown
+    } catch {
+      send(rpcError(null, -32700, "parse error"))
+      return
+    }
+    if (isJsonRpcRequest(parsed)) {
+      void dispatch(parsed).catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err)
+        send(rpcError(parsed.id ?? null, -32603, msg))
+      })
+    } else if (isJsonRpcResponse(parsed) && parsed.id === ROOTS_REQUEST_ID) {
+      dispatchRootsAnswer(parsed)
+    } else {
+      // Do not let null, arrays, scalars, responses for unknown ids, or malformed envelopes reach the
+      // dispatch shell. In particular, reading `.id` from a hostile `null` must never crash the loop.
+      send(rpcError(null, -32600, "Invalid Request"))
+    }
+  }
   for await (const chunk of Bun.stdin.stream()) {
-    buffer += decoder.decode(chunk as Uint8Array, { stream: true })
+    let text = decoder.decode(chunk as Uint8Array, { stream: true })
+    if (discardingOversized) {
+      const newline = text.indexOf("\n")
+      if (newline === -1) continue
+      text = text.slice(newline + 1)
+      discardingOversized = false
+    }
+    buffer += text
+    bufferBytes += STDIO_ENCODER.encode(text).byteLength
     let nl = buffer.indexOf("\n")
     while (nl !== -1) {
-      const line = buffer.slice(0, nl).trim()
+      const line = buffer.slice(0, nl)
       buffer = buffer.slice(nl + 1)
+      bufferBytes = Math.max(0, bufferBytes - STDIO_ENCODER.encode(line).byteLength - 1)
       nl = buffer.indexOf("\n")
-      if (line === "") continue
-      let message: JsonRpcRequest
-      try {
-        message = JSON.parse(line)
-      } catch {
-        send(rpcError(null, -32700, "parse error"))
-        continue
-      }
-      void dispatch(message).catch((err) => {
-        const msg = err instanceof Error ? err.message : String(err)
-        send(rpcError(message.id ?? null, -32603, msg))
-      })
+      processLine(line)
+    }
+    if (bufferBytes > MAX_STDIO_MESSAGE_BYTES) {
+      buffer = ""
+      bufferBytes = 0
+      discardingOversized = true
+      send(rpcError(null, -32600, "MCP message exceeded the size limit"))
     }
   }
 }
+
+function responseIdOf(message: JsonRpcResponse | JsonRpcNotification): string | number | null {
+  if (!("id" in message)) return null
+  const id = message.id
+  return id === null || typeof id === "string" || typeof id === "number" ? id : null
+}

package/src/project-facts.ts

@@ -1,5 +1,9 @@
 import type { CapabilityProjectReport } from "./capabilities-tool.ts"
-import type { CheckAssuranceContext, CheckConfig, CheckDiagnostic } from "./check-diagnostics.ts"
+import type {
+  CheckAssuranceContext,
+  CheckConfig,
+  CheckTypecheckResult,
+} from "./check-diagnostics.ts"
 import type {
   ManifestDriftFinding,
   SourceFinding,
@@ -12,6 +16,8 @@ import type { RulePack, SourceIndex } from "./rules/index.ts"
 
 export interface ProjectSourceFindings {
   readonly fetches: readonly SourceFinding[]
+  /** Hand-rolled `new EventSource("/…")` / `new WebSocket("/…")` to the app's own streaming surface. */
+  readonly streams: readonly SourceFinding[]
   readonly untypedClients: readonly SourceFinding[]
   readonly removedImports: readonly SourceFinding[]
   readonly responseRoutes: readonly SourceFinding[]
@@ -30,6 +36,22 @@ export interface ProjectPolicyFacts {
   readonly rulePacks: readonly RulePack[]
 }
 
+export interface ContractCheckFacts {
+  readonly present: boolean
+  readonly vacuous: boolean
+  readonly diagnostics: readonly { readonly route?: string; readonly message: string }[]
+  readonly error?: string
+}
+
+/** Check-wide inputs that rules format into diagnostics. Scanners populate facts; rules own policy. */
+export interface ProjectCheckFacts {
+  readonly typecheck: CheckTypecheckResult
+  readonly sqlCompilerAvailable: boolean
+  readonly checkConfigError?: string
+  readonly checkConfigWarnings: readonly string[]
+  readonly contracts: ContractCheckFacts
+}
+
 export interface ProjectFacts {
   readonly source: SourceIndex
   readonly routes: readonly StaticRouteFinding[]
@@ -37,11 +59,11 @@ export interface ProjectFacts {
   readonly packages: ProjectPackageFacts
   readonly pipeline?: PipelineReport
   readonly policies: ProjectPolicyFacts
+  readonly check: ProjectCheckFacts
   readonly sourceFindings: ProjectSourceFindings
-  readonly legacyDiagnostics: readonly CheckDiagnostic[]
 }
 
-export type ProjectFactsSeed = Omit<ProjectFacts, "legacyDiagnostics">
+export type ProjectFactsSeed = ProjectFacts
 
 function freezeFindings<T extends object>(findings: readonly T[]): readonly T[] {
   return Object.freeze(findings.map((finding) => Object.freeze({ ...finding })))
@@ -52,12 +74,10 @@ function freezeFindings<T extends object>(findings: readonly T[]): readonly T[]
  * these copied, frozen collections. Policy/config objects remain caller-owned because assurance config
  * can contain executable adapters and must not be frozen as a side effect of checking.
  */
-export function freezeProjectFacts(
-  seed: ProjectFactsSeed,
-  legacyDiagnostics: readonly CheckDiagnostic[],
-): ProjectFacts {
+export function freezeProjectFacts(seed: ProjectFactsSeed): ProjectFacts {
   const sourceFindings: ProjectSourceFindings = Object.freeze({
     fetches: freezeFindings(seed.sourceFindings.fetches),
+    streams: freezeFindings(seed.sourceFindings.streams),
     untypedClients: freezeFindings(seed.sourceFindings.untypedClients),
     removedImports: freezeFindings(seed.sourceFindings.removedImports),
     responseRoutes: freezeFindings(seed.sourceFindings.responseRoutes),
@@ -67,6 +87,15 @@ export function freezeProjectFacts(
     ...seed.policies,
     rulePacks: Object.freeze([...seed.policies.rulePacks]),
   })
+  const check = Object.freeze({
+    ...seed.check,
+    typecheck: Object.freeze({ ...seed.check.typecheck }),
+    checkConfigWarnings: Object.freeze([...seed.check.checkConfigWarnings]),
+    contracts: Object.freeze({
+      ...seed.check.contracts,
+      diagnostics: freezeFindings(seed.check.contracts.diagnostics),
+    }),
+  })
   return Object.freeze({
     ...seed,
     source: Object.freeze(seed.source),
@@ -78,7 +107,7 @@ export function freezeProjectFacts(
     }),
     ...(seed.pipeline === undefined ? {} : { pipeline: Object.freeze(seed.pipeline) }),
     policies,
+    check,
     sourceFindings,
-    legacyDiagnostics: freezeFindings(legacyDiagnostics),
   })
 }