@nudojs/core 1.14.0 → 1.15.0

package/dist/index.js

@@ -2,12 +2,14 @@ import "./chunk-US532PZA.js";
 import {
   INTERFACE_SOURCE_ABBR,
   NudoSidecarError,
+  actionsForIssue,
   buildArgsFromAssume,
   canSkipLiteralCallScan,
   collectAbsFreeVars,
   effectiveInterface,
   evictGeneralizeMemoForPaths,
   execNudoModule,
+  extractAllLoadSpecs,
   extractAssumeSegs,
   extractBalancedParens,
   extractDeclaredThrows,
@@ -23,8 +25,11 @@ import {
   findFnDirectiveScope,
   fnDirectiveCommentLines,
   fnTopLevelLocalNames,
+  formatCheckReport,
   formatConstraint,
   formatEffectiveInterfaceDisplay,
+  formatGithubAnnotations,
+  formatGitlabCodeQuality,
   formatInterfaceTierLine,
   generalizeAll,
   generalizeFromAst,
@@ -57,6 +62,8 @@ import {
   scanContractSegments,
   scanLiteralCalls,
   scanThrowsDecl,
+  serializeCheckJson,
+  serializeCheckJsonMulti,
   setInterfaceDiagCollector,
   setRefineDiagCollector,
   sidecarClosureFingerprint,
@@ -67,7 +74,7 @@ import {
   takeInterfaceDiagsSince,
   takeRefineDiags,
   takeRefineDiagsSince
-} from "./chunk-N7AGFMSD.js";
+} from "./chunk-47UPDZHE.js";
 import {
   $add,
   $arguments,
@@ -183,6 +190,7 @@ import {
   CONSTRAINT_BUILDER_NAMES,
   CONSTRAINT_EXPR_RE,
   DEFAULT_MAX_LOOP_ITERS,
+  DIAG,
   FORK_TRUNCATION_LABEL,
   HOST_EFFECT_LABEL_PREFIX,
   LOOP_TRUNCATION_LABEL,
@@ -528,7 +536,7 @@ import {
   withExecPhi,
   withInvariantSpecs,
   withVar
-} from "./chunk-W3Z77Y2I.js";
+} from "./chunk-NUTYUT3I.js";
 
 // src/environment.ts
 function createEnvironment(parent, bindings = /* @__PURE__ */ new Map()) {
@@ -650,7 +658,7 @@ function checkArg(arg, expect, phi = pTrue) {
   if (arg.shape.k === "unknown" && !arg.term) {
     return {
       severity: "warning",
-      code: "nudo:arg-opaque",
+      code: DIAG.argOpaque,
       message: `argument type is unknown; cannot verify constraint ${predToString(expect)}`,
       suggestion: "add a call site or @nudo:case, or provide preconditions via --assume"
     };
@@ -664,7 +672,7 @@ function checkArg(arg, expect, phi = pTrue) {
     if (ok === false) {
       return {
         severity: "error",
-        code: "nudo:constraint-violated",
+        code: DIAG.constraintViolated,
         message: `argument ${JSON.stringify(lvR.value)} does not satisfy ${predToString(expect)}`,
         suggestion: `use a value satisfying the constraint, or relax the function precondition`
       };
@@ -672,7 +680,7 @@ function checkArg(arg, expect, phi = pTrue) {
   }
   return {
     severity: "warning",
-    code: "nudo:constraint-unproven",
+    code: DIAG.constraintUnproven,
     message: `cannot prove the argument satisfies ${predToString(expect)}`,
     suggestion: `not enough information; use --assume or add a case`
   };
@@ -701,7 +709,7 @@ function checkCall(source, fnName, args, phi = pTrue) {
   if (!g) {
     diags.push({
       severity: "error",
-      code: "nudo:fn-not-found",
+      code: DIAG.fnNotFound,
       message: `function ${fnName} not found`
     });
     return diags;
@@ -709,7 +717,7 @@ function checkCall(source, fnName, args, phi = pTrue) {
   if (args.length !== g.params.length) {
     diags.push({
       severity: "error",
-      code: "nudo:arg-count",
+      code: DIAG.argCount,
       message: `${fnName} expects ${g.params.length} argument(s), got ${args.length}`,
       fn: fnName
     });
@@ -724,7 +732,7 @@ function checkCall(source, fnName, args, phi = pTrue) {
   if (g.symbolic.conf === "partial" || g.symbolic.conf === "opaque") {
     diags.push({
       severity: "info",
-      code: "nudo:partial-result",
+      code: DIAG.partialResult,
       message: `${fnName}(...) result confidence ${g.symbolic.conf}`,
       suggestion: "add a call site or constraint to improve precision",
       fn: fnName
@@ -761,6 +769,9 @@ function formatDiagnostics(diags) {
   }).join("\n");
 }
 
+// src/algebra/check.ts
+import { isBuiltin } from "module";
+
 // src/algebra/postcondition.ts
 function proved() {
   return { status: "proved" };
@@ -1489,7 +1500,7 @@ function interfaceDriftIssues(candidates, callRecords, evalResult) {
       if (leqAbs(today2, expected2).ok && leqAbs(expected2, today2).ok) continue;
       out.push({
         severity: "warning",
-        code: "nudo:interface-drift",
+        code: DIAG.interfaceDrift,
         message: `${cand.fnName}[${param}]: persisted @generated segment \u2260 today's call-site domain`,
         actual: formatAbs(today2),
         expected: formatConstraint(constraint),
@@ -1514,7 +1525,7 @@ function interfaceDriftIssues(candidates, callRecords, evalResult) {
     if (leqAbs(today, expected).ok && leqAbs(expected, today).ok) continue;
     out.push({
       severity: "warning",
-      code: "nudo:interface-drift",
+      code: DIAG.interfaceDrift,
       message: `${cand.fnName}[return]: persisted @generated segment \u2260 today's inferred return`,
       actual: formatAbs(today),
       expected: formatConstraint(retC),
@@ -1715,7 +1726,9 @@ function moduleMapId(m) {
 function checkMemoKey(filePath, source, identityOpts, deps, sidecarFp) {
   return [
     hashSource(source),
-    filePath,
+    // filePath 过 stablePathKey 归一（与依赖索引/逐出同口径）：同一文件的
+    // 裸路径与 file:// URL 两种形态不得各占一条 memo 条目（命中率损耗）。
+    stablePathKey(filePath),
     `${loadModuleId(identityOpts.loadModule)}:${identityOpts.fromFile ?? ""}`,
     deps.fp,
     sidecarFp ?? "-",
@@ -1933,7 +1946,7 @@ function structuralAssignIssues(records) {
     if (!leq.ok) {
       out.push({
         severity: "error",
-        code: "nudo:assign-mismatch",
+        code: DIAG.assignMismatch,
         message: `${r.name}: assignment \u22AD existing shape`,
         actual: formatAbs(r.next),
         expected: formatAbs(r.prev),
@@ -2076,7 +2089,7 @@ function scanCaseInconsistency(source, knownFns, opts) {
             const field = fieldPath.join(".");
             out.push({
               severity: "error",
-              code: "nudo:case-inconsistency",
+              code: DIAG.caseInconsistency,
               message: `${fnName} case "${caseName}": witness \u22AD contract`,
               actual: formatAbs(arg),
               expected: `missing field ${field}`,
@@ -2100,7 +2113,7 @@ function scanCaseInconsistency(source, knownFns, opts) {
           const paramName = entry.param || paramNames[idx] || `arg${idx}`;
           out.push({
             severity: "error",
-            code: "nudo:case-inconsistency",
+            code: DIAG.caseInconsistency,
             message: `${fnName} case "${caseName}": witness \u22AD contract`,
             actual: formatAbs(arg),
             expected: formatConstraint(entry.constraint),
@@ -2116,7 +2129,7 @@ function scanCaseInconsistency(source, knownFns, opts) {
         const paramName = entry.param || paramNames[idx] || `arg${idx}`;
         out.push({
           severity: "error",
-          code: "nudo:case-inconsistency",
+          code: DIAG.caseInconsistency,
           message: `${fnName} case "${caseName}": witness \u22AD contract`,
           actual: formatAbs(arg),
           expected: formatConstraint(entry.constraint),
@@ -2138,7 +2151,7 @@ function scanCaseInconsistency(source, knownFns, opts) {
             const paramName = entry.param || paramNames[idx] || `arg${idx}`;
             out.push({
               severity: "error",
-              code: "nudo:case-inconsistency",
+              code: DIAG.caseInconsistency,
               message: `${fnName} case "${caseName}": witness \u22AD contract`,
               actual: formatAbs(arg),
               expected: predToString(p),
@@ -2365,7 +2378,7 @@ function sidecarDiagIssues(diags) {
     const k = `${d.code}\0${d.message}`;
     if (seen.has(k)) continue;
     seen.add(k);
-    const severity = d.code === "nudo:contract-syntax" || d.code === "nudo:directive-syntax" ? "warning" : "error";
+    const severity = d.code === DIAG.contractSyntax || d.code === DIAG.directiveSyntax ? "warning" : "error";
     out.push({ severity, code: d.code, message: d.message });
   }
   return out;
@@ -2387,7 +2400,7 @@ function assumePremisesPhiOf(name, source, file, issues) {
     if (seg.kind === "bad") {
       issues.push({
         severity: "error",
-        code: "nudo:assume-invalid",
+        code: DIAG.assumeInvalid,
         message: `${name}: malformed @nudo:assume '${seg.raw}' (expected <param> <= <param> or <param> >= <param>; constant bounds belong to sidecar contracts)`,
         actual: seg.raw,
         expected: "<param> <= <param>",
@@ -2400,7 +2413,7 @@ function assumePremisesPhiOf(name, source, file, issues) {
     if (bad.length > 0) {
       issues.push({
         severity: "error",
-        code: "nudo:assume-invalid",
+        code: DIAG.assumeInvalid,
         message: `${name}: @nudo:assume name(s) not bound as parameters or top-level locals (${bad.join(", ")})`,
         actual: bad.join(", "),
         expected: surface || "(no params/locals)",
@@ -2431,7 +2444,7 @@ function invariantSpecsOf(name, source, file, issues) {
     if (seg.kind === "bad") {
       issues.push({
         severity: "warning",
-        code: "nudo:invariant-invalid",
+        code: DIAG.invariantInvalid,
         message: `${name}: malformed @nudo:invariant '${seg.raw}' (expected <name><path> <rel> <number>; path = [*] or .member steps)`,
         actual: seg.raw,
         expected: "<name><path> <rel> <number>",
@@ -2443,7 +2456,7 @@ function invariantSpecsOf(name, source, file, issues) {
     if (!bindable.has(seg.name)) {
       issues.push({
         severity: "warning",
-        code: "nudo:invariant-invalid",
+        code: DIAG.invariantInvalid,
         message: `${name}: @nudo:invariant name not bound as a parameter or top-level local (${seg.name})`,
         actual: seg.name,
         expected: surface || "(no params/locals)",
@@ -2458,12 +2471,20 @@ function invariantSpecsOf(name, source, file, issues) {
   if (specs.length === 0) return void 0;
   return { specs, display };
 }
+var OPAQUE_EVIDENCE_HINT = "add @nudo:case or a call site";
+var OPAQUE_ENV_HINT = "declare the runtime env to type native modules: '/// @nudo:env node' (or web/es) \u2014 see guides/env-harvest.md";
+function isBuiltinModuleSpec(spec) {
+  if (spec.startsWith(".") || spec.startsWith("/")) return false;
+  const base = (spec.startsWith("node:") ? spec.slice("node:".length) : spec).split("/")[0];
+  return base.length > 0 && isBuiltin(base);
+}
 function checkSourceInner(filePath, source, file, phi, opts, issues, signatures, names, truncated, identityOpts = opts, depsFp, sidecarFp) {
   const hasRefineDirective = stripStringsKeepComments(source).includes("@nudo:contract");
   const entryNames = localNamedExports(source);
   const exportedNames = sidecarFp !== void 0 ? entryNames : void 0;
   const entryThrowsMode = opts.entryThrows ?? "error";
   const ignoreThrows = opts.ignoreThrows;
+  const opaqueEnvHint = Object.keys(opts.inject?.envGlobals ?? {}).length === 0 && extractFileEnvNames(source).length === 0 && extractAllLoadSpecs(source).some(isBuiltinModuleSpec);
   const driftCandidates = [];
   const returnContracts = /* @__PURE__ */ new Map();
   const returnViolated = /* @__PURE__ */ new Set();
@@ -2574,7 +2595,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
           const loc = findFnLoc(file, name);
           issues.push({
             severity: entryThrowsMode === "warning" ? "warning" : "error",
-            code: "nudo:entry-may-throw",
+            code: DIAG.entryMayThrow,
             message: `${name} (export): may throw ${gateDisplay}`,
             actual: `${name}(\u2026)    throws ${gateDisplay}`,
             expected: "entry total, or @nudo:throws / try-catch",
@@ -2599,7 +2620,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
       }
       issues.push({
         severity: "warning",
-        code: "nudo:no-signature",
+        code: DIAG.noSignature,
         message: `${name}: could not generalize a symbolic Abs`,
         suggestion: "add @nudo:case or make the body algebraically evaluable",
         fn: name
@@ -2619,7 +2640,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
         const loc = findFnLoc(file, name);
         issues.push({
           severity: entryThrowsMode === "warning" ? "warning" : "error",
-          code: "nudo:entry-may-throw",
+          code: DIAG.entryMayThrow,
           message: `${name} (export): may throw ${gateDisplay}`,
           actual: `${formatEntrySigLine(name, g, gateDisplay)}`,
           expected: "entry total, or @nudo:throws / try-catch",
@@ -2663,7 +2684,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
       const where = symbolicTrueUnknown ? `${name} => unknown` : `${name} param ${g.params[unknownParamIdx] ?? `#${unknownParamIdx}`}: unknown`;
       issues.push({
         severity: "warning",
-        code: "nudo:unknown-inference",
+        code: DIAG.unknownInference,
         message: `${name}: signature has true unknown (inference failed)`,
         actual: where,
         expected: "computable Abs (any = unconstrained, unknown = engine debt)",
@@ -2684,7 +2705,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
           const surface = [...contractNames].filter((n) => !n.startsWith("_p") && n !== "_").join(", ");
           issues.push({
             severity: "error",
-            code: "nudo:interface-param-mismatch",
+            code: DIAG.interfaceParamMismatch,
             message: `${name}: contract parameter name(s) not in the formal parameter list (${unknownParams.join(", ")})`,
             actual: unknownParams.join(", "),
             expected: surface || g.params.join(", ") || "(no params)",
@@ -2697,7 +2718,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
         if (eff.conflict.params.length > 0) {
           issues.push({
             severity: "error",
-            code: "nudo:interface-conflict",
+            code: DIAG.interfaceConflict,
             message: `${name}: handwritten contract conjunction unsatisfiable (${eff.conflict.params.join(", ")})`,
             suggestion: "check whether the source @nudo:contract and the same-name sidecar binding have contradictory constant bounds",
             fn: name
@@ -2706,7 +2727,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
         if (eff.conflict.returns) {
           issues.push({
             severity: "error",
-            code: "nudo:interface-conflict",
+            code: DIAG.interfaceConflict,
             message: `${name}: handwritten contract conjunction unsatisfiable on the return slot`,
             suggestion: "check whether the source @nudo:contract return and the sidecar fn() return constraint are contradictory (the return slot is not enforced when they are)",
             fn: name
@@ -2742,9 +2763,9 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (g.symbolic.conf === "opaque" && !truncated.has(name)) {
       issues.push({
         severity: "info",
-        code: "nudo:opaque-result",
+        code: DIAG.opaqueResult,
         message: `${name}(...): conf=opaque (path not covered, or native)`,
-        suggestion: "add @nudo:case or a call site",
+        suggestion: opaqueEnvHint ? OPAQUE_ENV_HINT : OPAQUE_EVIDENCE_HINT,
         fn: name
       });
     }
@@ -2753,7 +2774,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (label === FORK_TRUNCATION_LABEL) {
       issues.push({
         severity: "info",
-        code: "nudo:fork-truncated",
+        code: DIAG.forkTruncated,
         message: `Branch expansion was truncated (fork budget); affected results widened to unknown#opaque (budget)`,
         suggestion: "optional: raise nudo.analysis.maxForks, or @nudo:budget forks=\u2026 on the function \u2014 non-blocking"
       });
@@ -2762,7 +2783,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (label === PROMISE_MICRO_OVERFLOW_LABEL) {
       issues.push({
         severity: "info",
-        code: "nudo:promise-micro-truncated",
+        code: DIAG.promiseMicroTruncated,
         message: `Promise microtask queue hit its hard cap; further then/catch callbacks were dropped (results stay fail-closed)`,
         suggestion: "optional: reduce top-level Promise.then fan-out \u2014 non-blocking"
       });
@@ -2771,7 +2792,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (label === PROMISE_MICRO_ERROR_LABEL) {
       issues.push({
         severity: "info",
-        code: "nudo:promise-micro-error",
+        code: DIAG.promiseMicroError,
         message: `A promise microtask threw while draining; the error was recorded and did not rewrite the synchronous return value`,
         suggestion: "optional: inspect the then/catch callback for a throw path \u2014 non-blocking"
       });
@@ -2780,7 +2801,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (label === MATH_FOLD_ERROR_LABEL) {
       issues.push({
         severity: "info",
-        code: "nudo:math-fold-error",
+        code: DIAG.mathFoldError,
         message: `A Math native fold threw during analysis (host-tampered or divergent Math.*); the result was widened to number`,
         suggestion: "optional: keep Math.* builtins unmodified in analyzed code, or mock them with @nudo:mock \u2014 non-blocking"
       });
@@ -2790,7 +2811,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
       const hostName = label.slice(HOST_EFFECT_LABEL_PREFIX.length);
       issues.push({
         severity: "info",
-        code: "nudo:host-effect-blocked",
+        code: DIAG.hostEffectBlocked,
         message: `Host function '${hostName}' is not executed during analysis (network/timer side effect); result widened to unknown#opaque`,
         suggestion: "optional: mock it with @nudo:mock / @nudo:env, or pass the value in from a call site",
         fn: hostName
@@ -2800,7 +2821,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     if (label === LOOP_TRUNCATION_LABEL) {
       issues.push({
         severity: "info",
-        code: "nudo:loop-truncated",
+        code: DIAG.loopTruncated,
         message: `A loop did not terminate within its iteration budget (abstract unroll cap reached and the exit condition stayed concrete-true); affected loop state was widened (bounded, not exact)`,
         suggestion: "optional: restructure so the exit condition becomes abstract (data-dependent) within a few iterations, or pin the result with @nudo:case / @nudo:contract \u2014 non-blocking"
       });
@@ -2811,7 +2832,7 @@ function checkSourceInner(filePath, source, file, phi, opts, issues, signatures,
     const calls = reasons.has("calls");
     issues.push({
       severity: "info",
-      code: "nudo:recursion-truncated",
+      code: DIAG.recursionTruncated,
       message: allCycle ? `Recursive evaluation of '${label}' hit a call cycle (same abstract arguments already on the stack); result widened to unknown#opaque (cycle \u2014 budget cannot lift this)` : `Recursive evaluation of '${label}' was truncated (${depth && calls ? "depth/size budget" : depth ? "call-depth budget" : calls ? "total-calls budget" : "depth/size budget"}); result widened to unknown#opaque (budget \u2014 not inference debt)`,
       suggestion: allCycle ? "a call cycle is not a budget: make the recursion arguments vary per level, narrow the base case, or declare @nudo:contract \u2014 raising @nudo:budget will not change this" : depth && !calls ? "raise the function budget with @nudo:budget depth=\u2026 (or narrow the recursion base case / declare @nudo:contract return)" : calls && !depth ? "raise the function budget with @nudo:budget calls=\u2026 (or narrow the recursion base case / declare @nudo:contract return)" : "raise the function budget with @nudo:budget calls=\u2026 depth=\u2026 (or narrow the recursion base case / declare @nudo:contract return)",
       reason: allCycle ? "cycle" : depth && calls ? "budget" : depth ? "depth" : calls ? "calls" : "budget",
@@ -2934,7 +2955,7 @@ function checkReturnConstraint(fnName, cName, constraint, ret, assumeDisplay, in
     if (assumeDisplay && assumeDisplay.length > 0) {
       relied.push({
         severity: "info",
-        code: "nudo:assume-relied",
+        code: DIAG.assumeRelied,
         message: `${fnName}: return contract proved via @nudo:assume ${assumeDisplay.join("; ")}`,
         actual: `proof relies on user lemma${assumeDisplay.length > 1 ? "s" : ""}`,
         expected: "engine verifies the obligation, not the lemma itself",
@@ -2945,7 +2966,7 @@ function checkReturnConstraint(fnName, cName, constraint, ret, assumeDisplay, in
     if (invariantDisplay && invariantDisplay.length > 0) {
       relied.push({
         severity: "info",
-        code: "nudo:invariant-relied",
+        code: DIAG.invariantRelied,
         message: `${fnName}: return contract proved via @nudo:invariant ${invariantDisplay.join("; ")}`,
         actual: `proof relies on user invariant${invariantDisplay.length > 1 ? "s" : ""}`,
         expected: "engine verifies the obligation, not the loop invariant itself",
@@ -2958,7 +2979,7 @@ function checkReturnConstraint(fnName, cName, constraint, ret, assumeDisplay, in
   const push = (severity, actual, expected, suggestion) => [
     {
       severity,
-      code: severity === "error" ? "nudo:constraint-violated" : "nudo:unproven-return",
+      code: severity === "error" ? DIAG.constraintViolated : DIAG.unprovenReturn,
       message: `${fnName}: return value \u22AD @nudo:contract return ${cName}`,
       actual,
       expected,
@@ -2981,361 +3002,6 @@ function checkReturnConstraint(fnName, cName, constraint, ret, assumeDisplay, in
     `${proof.reason}; add a precondition, narrow the return expression, or relax the return contract`
   );
 }
-
-// src/algebra/check-report.ts
-function actionsForIssue(i) {
-  const draft = {
-    kind: "draft",
-    command: "nudo contract --draft",
-    label: "emit a sidecar draft you can edit"
-  };
-  switch (i.code) {
-    case "nudo:constraint-violated":
-      return [
-        {
-          kind: "callsite",
-          label: "use a value satisfying the constraint",
-          ...i.expected ? { hint: i.expected } : {}
-        },
-        {
-          kind: "relax",
-          label: "relax the precondition (edit *.nudo.js / @nudo:contract)",
-          ...i.expected ? { hint: i.expected } : {}
-        },
-        draft
-      ];
-    case "nudo:assign-mismatch":
-      return [
-        {
-          kind: "callsite",
-          label: "align the assigned value with the existing shape",
-          ...i.expected ? { hint: i.expected } : {}
-        },
-        draft
-      ];
-    case "nudo:entry-may-throw":
-      return [
-        {
-          kind: "draft",
-          command: "nudo contract --draft",
-          label: "narrow the entry with a sidecar fn({ \u2026 }) param contract \u2014 most honest fix for helpers (also tightens the signature)",
-          ...i.fn ? { hint: i.fn } : {}
-        },
-        {
-          kind: "relax",
-          label: "declare intentional fail-fast: @nudo:throws Error (or case `!! throws`)",
-          ...i.fn ? { hint: i.fn } : {}
-        },
-        {
-          kind: "info",
-          label: "or refine / guard / try-catch the entry so it is total"
-        },
-        {
-          kind: "ignore-throws",
-          command: "nudo check --ignore-throws TypeError",
-          label: "migration switch: ignore this throw class on L2"
-        }
-      ];
-    case "nudo:unproven-return":
-      return [
-        {
-          kind: "relax",
-          label: `relax the return contract${i.fn ? ` of ${i.fn}` : ""} to the inferred surface (review the diff \u2014 not a silent green)`,
-          ...i.expected ? { hint: i.expected } : {}
-        },
-        draft,
-        {
-          kind: "info",
-          label: "or narrow the return expression / add a precondition so the bound is implied"
-        }
-      ];
-    case "nudo:unknown-inference":
-    case "nudo:opaque-result":
-      return [
-        { kind: "mock", label: "pin the native/unknown face with @nudo:mock" },
-        { kind: "assume", command: "nudo check --assume", label: "state preconditions via --assume" },
-        { kind: "info", label: "or add a call site / @nudo:case for evidence" }
-      ];
-    case "nudo:arg-opaque":
-    case "nudo:constraint-unproven":
-      return [
-        { kind: "assume", command: "nudo check --assume", label: "state preconditions via --assume" },
-        { kind: "info", label: "add a call site or @nudo:case" }
-      ];
-    case "nudo:fork-truncated":
-    case "nudo:promise-micro-truncated":
-    case "nudo:promise-micro-error":
-      return [
-        {
-          kind: "info",
-          label: "results widened to unknown \u2014 raise budget (@nudo:budget forks/calls/depth on the function) or narrow control flow"
-        }
-      ];
-    case "nudo:loop-truncated":
-      return [
-        {
-          kind: "info",
-          label: "loop state widened \u2014 the exit condition stayed concrete-true past the iteration cap; make the bound data-dependent (abstract) or pin the result with @nudo:case / @nudo:contract"
-        }
-      ];
-    case "nudo:recursion-truncated":
-      return [
-        {
-          kind: "info",
-          label: i.reason === "cycle" ? "call cycle: same abstract arguments already on the stack \u2014 raising @nudo:budget cannot lift it; make the arguments vary per recursion level or declare @nudo:contract" : i.reason === "depth" || i.reason === "calls" || i.reason === "budget" ? `results widened to unknown \u2014 raise budget (@nudo:budget ${i.reason === "depth" ? "depth" : i.reason === "calls" ? "calls" : "calls/depth"} on the function) or narrow the recursion` : "results widened to unknown \u2014 raise budget (@nudo:budget calls/depth on the function) or narrow control flow"
-        }
-      ];
-    case "nudo:host-effect-blocked":
-      return [
-        { kind: "mock", label: "pin the host API with @nudo:mock / @nudo:env" },
-        { kind: "info", label: "results widened to unknown \u2014 or feed the value in from a call site" }
-      ];
-    case "nudo:interface-drift":
-      return [
-        {
-          kind: "emit",
-          command: "nudo contract --emit",
-          label: "refresh the @generated segment"
-        }
-      ];
-    case "nudo:dual-entry":
-      return [
-        {
-          kind: "info",
-          label: "browser/node records do not cross files \u2014 analyze the entry you ship; mock or skip the other variant"
-        }
-      ];
-    default:
-      return i.suggestion ? [{ kind: "info", label: i.suggestion }] : [];
-  }
-}
-function serializeCheckJson(r) {
-  return {
-    version: 1,
-    file: r.file,
-    ok: r.ok,
-    summary: { ...r.summary },
-    signatures: r.signatures.map((s) => ({
-      name: s.name,
-      params: [...s.params],
-      ...s.paramTypes ? { paramTypes: [...s.paramTypes] } : {},
-      display: s.display,
-      detail: s.detail,
-      conf: s.conf,
-      abs: formatAbs(s.abs),
-      ...s.throws ? { throws: s.throws } : {},
-      ...s.entry ? { entry: true } : {}
-    })),
-    issues: r.issues.map((i) => {
-      const acts = i.actions ?? actionsForIssue(i);
-      return {
-        severity: i.severity,
-        code: i.code,
-        message: i.message,
-        ...i.fn !== void 0 ? { fn: i.fn } : {},
-        ...i.line !== void 0 ? { line: i.line } : {},
-        ...i.column !== void 0 ? { column: i.column } : {},
-        ...i.actual !== void 0 ? { actual: i.actual } : {},
-        ...i.expected !== void 0 ? { expected: i.expected } : {},
-        ...i.suggestion !== void 0 ? { suggestion: i.suggestion } : {},
-        ...i.reason !== void 0 ? { reason: i.reason } : {},
-        ...acts.length > 0 ? { actions: acts } : {}
-      };
-    }),
-    ...r.budget ? { budget: { ...r.budget } } : {}
-  };
-}
-function serializeCheckJsonMulti(reports) {
-  const summary = {
-    errors: 0,
-    warnings: 0,
-    infos: 0,
-    functions: 0,
-    files: reports.length
-  };
-  let calls = 0;
-  let forks = 0;
-  let maxCalls = 0;
-  let maxForks = 0;
-  let callTruncated = false;
-  let forkTruncated = false;
-  let evalCalls = 0;
-  let maxEvalCalls = 0;
-  let evalCallTruncated = false;
-  let cycleTruncated = false;
-  let loopTruncated = false;
-  const reasons = /* @__PURE__ */ new Set();
-  for (const r of reports) {
-    summary.errors += r.summary.errors;
-    summary.warnings += r.summary.warnings;
-    summary.infos += r.summary.infos;
-    summary.functions += r.summary.functions;
-    if (r.budget) {
-      calls += r.budget.calls;
-      forks += r.budget.forks;
-      maxCalls = Math.max(maxCalls, r.budget.maxCalls);
-      maxForks = Math.max(maxForks, r.budget.maxForks);
-      callTruncated = callTruncated || r.budget.callTruncated;
-      forkTruncated = forkTruncated || r.budget.forkTruncated;
-      evalCalls += r.budget.evalCalls ?? 0;
-      maxEvalCalls = Math.max(maxEvalCalls, r.budget.maxEvalCalls ?? 0);
-      evalCallTruncated = evalCallTruncated || (r.budget.evalCallTruncated ?? false);
-      cycleTruncated = cycleTruncated || (r.budget.cycleTruncated ?? false);
-      loopTruncated = loopTruncated || (r.budget.loopTruncated ?? false);
-      for (const x of r.budget.reasons ?? []) reasons.add(x);
-    }
-  }
-  const budgetTruncated = callTruncated || evalCallTruncated || forkTruncated || loopTruncated;
-  return {
-    version: 1,
-    kind: "multi",
-    ok: reports.every((r) => r.ok),
-    summary: {
-      ...summary,
-      ...budgetTruncated ? { budgetTruncated: true } : {}
-    },
-    ...budgetTruncated || reports.some((r) => r.budget) ? {
-      budget: {
-        truncated: budgetTruncated,
-        callTruncated,
-        forkTruncated,
-        calls,
-        maxCalls,
-        forks,
-        maxForks,
-        evalCalls,
-        maxEvalCalls,
-        evalCallTruncated,
-        cycleTruncated,
-        loopTruncated,
-        reasons: [...reasons].sort()
-      }
-    } : {},
-    reports
-  };
-}
-var CONTRACT_FIX_CODES = /* @__PURE__ */ new Set([
-  "nudo:constraint-violated",
-  "nudo:assign-mismatch",
-  "nudo:arg-structure",
-  "nudo:interface-domain-exceeds",
-  "nudo:entry-may-throw",
-  "nudo:missing-slot"
-]);
-function formatCheckReport(r, opts = {}) {
-  const lines = [];
-  lines.push(`nudo check  ${r.file}`);
-  lines.push(r.ok ? "OK" : "FAILED");
-  lines.push(
-    `  ${r.summary.errors} error \xB7 ${r.summary.warnings} warning \xB7 ${r.summary.infos} info \xB7 ${r.summary.functions} fn`
-  );
-  if (r.budget?.truncated) {
-    const onlyLoop = r.budget.loopTruncated && !r.budget.callTruncated && !r.budget.evalCallTruncated && !r.budget.forkTruncated;
-    lines.push("");
-    lines.push("budget");
-    lines.push(
-      `  truncated  calls ${r.budget.calls}/${r.budget.maxCalls} \xB7 eval calls ${r.budget.evalCalls}/${r.budget.maxEvalCalls} \xB7 forks ${r.budget.forks}/${r.budget.maxForks}${r.budget.callTruncated ? "  (calls)" : ""}${r.budget.evalCallTruncated ? "  (eval calls)" : ""}${r.budget.forkTruncated ? "  (forks)" : ""}${r.budget.loopTruncated ? "  (loop iters)" : ""}`
-    );
-    lines.push(
-      r.budget.cycleTruncated ? `  \u2192 some results widened to unknown (not a contract failure) \u2014 includes call cycles (same abstract args; a budget cannot lift them)` : onlyLoop ? `  \u2192 loop state widened (iteration budget, not a contract failure) \u2014 @nudo:budget does not apply; make the bound data-dependent or pin with @nudo:case / @nudo:contract` : `  \u2192 some results widened to unknown (not a contract failure) \u2014 raise @nudo:budget / nudo.analysis.maxForks or simplify recursion`
-    );
-  }
-  if (r.signatures.length > 0) {
-    lines.push("");
-    lines.push("signatures");
-    for (const s of r.signatures) {
-      const paramStr = s.paramTypes && s.paramTypes.length > 0 ? s.params.map((p, i) => `${p}: ${s.paramTypes[i] ?? "any"}`).join(", ") : s.params.join(", ");
-      const throwsStr = s.throws ? `  throws ${s.throws}` : "";
-      const displayBase = s.display.replace(/\s+throws\s+[\s\S]+$/, "").trim();
-      const shapeK = s.abs?.shape?.k;
-      const looksLikeFakeAny = shapeK === "any" && displayBase.length > 0 && !/^any(\b|$)/.test(displayBase);
-      const retStr = !looksLikeFakeAny && shapeK ? formatShape(s.abs) || displayBase.replace(/\s+#\w+$/, "").trim() : displayBase.replace(/\s+#\w+$/, "").trim();
-      lines.push(`  ${s.name}(${paramStr}) => ${retStr}${throwsStr}`);
-      if (opts.verbose) {
-        for (const ln of s.detail.split("\n").slice(1)) {
-          lines.push(`  ${ln}`);
-        }
-      }
-    }
-  }
-  if (r.issues.length === 0) {
-    lines.push("");
-    lines.push("(no issues)");
-  } else {
-    lines.push("");
-    lines.push("issues");
-    for (const i of r.issues) {
-      const loc = i.line != null ? `L${i.line}` : "";
-      const head = [i.severity.toUpperCase(), loc, i.fn].filter(Boolean).join(" ");
-      lines.push(`  [${head}] ${i.message}  (${i.code})`);
-      const showDetail = i.severity === "error" || opts.verbose;
-      if (showDetail && i.actual) lines.push(`      actual:   ${i.actual}`);
-      if (showDetail && i.expected) lines.push(`      expected: ${i.expected}`);
-      if (i.suggestion) {
-        lines.push(`      \u2192 ${i.suggestion}`);
-      } else if (CONTRACT_FIX_CODES.has(i.code)) {
-        lines.push(`      \u2192 add a refine / sidecar contract, or fix the call-site value`);
-      }
-      if (CONTRACT_FIX_CODES.has(i.code)) {
-        lines.push(`      fix:  nudo contract --draft  (emit a sidecar draft you can edit)`);
-      }
-    }
-  }
-  return lines.join("\n");
-}
-function escapeGhaData(s) {
-  return s.replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
-}
-function escapeGhaProp(s) {
-  return escapeGhaData(s).replace(/:/g, "%3A").replace(/,/g, "%2C");
-}
-function formatGithubAnnotations(r, opts = {}) {
-  const lines = [];
-  let file = r.file;
-  if (opts.workspaceRoot && file.startsWith(opts.workspaceRoot)) {
-    file = file.slice(opts.workspaceRoot.length).replace(/^[/\\]/, "");
-  }
-  for (const i of r.issues) {
-    const level = i.severity === "error" ? "error" : i.severity === "warning" ? "warning" : "notice";
-    const line = i.line ?? 1;
-    const col = (i.column ?? 0) + 1;
-    const title = escapeGhaProp(i.code);
-    const msgBits = [i.message];
-    if (i.actual && i.expected) msgBits.push(`${i.actual} \u22AD ${i.expected}`);
-    else if (i.suggestion) msgBits.push(i.suggestion);
-    if (CONTRACT_FIX_CODES.has(i.code)) {
-      msgBits.push(`fix: nudo contract --draft`);
-    }
-    const msg = escapeGhaData(msgBits.join(" \xB7 "));
-    const props = [
-      `file=${escapeGhaProp(file)}`,
-      `line=${line}`,
-      `col=${col}`,
-      `title=${title}`
-    ].join(",");
-    lines.push(`::${level} ${props}::${msg}`);
-  }
-  return lines.join("\n");
-}
-function formatGitlabCodeQuality(r, opts = {}) {
-  let file = r.file;
-  if (opts.workspaceRoot && file.startsWith(opts.workspaceRoot)) {
-    file = file.slice(opts.workspaceRoot.length).replace(/^[/\\]/, "");
-  }
-  return r.issues.map((i) => {
-    const begin = i.line ?? 1;
-    const severity = i.severity === "error" ? "major" : i.severity === "warning" ? "minor" : "info";
-    const description = i.actual && i.expected ? `${i.message} (${i.actual} \u22AD ${i.expected})` : i.message;
-    const fingerprint = `${file}:${i.code}:${begin}:${i.message}`;
-    return {
-      description,
-      check_name: i.code,
-      fingerprint,
-      severity,
-      location: { path: file, lines: { begin } }
-    };
-  });
-}
 export {
   $add,
   $arguments,