kibi-cli 2.39.0 → 2.40.0

package/dist/operations/proof/explain.js

@@ -148,6 +148,7 @@ export function projectRequirementExplain(proof) {
                 }),
             }
             : {}),
+        ...refutationFields(proof, stages),
         ...claimFields(proof),
         scenarios,
         ...negativePathField(stages.negativePath),
@@ -314,6 +315,51 @@ function renderNegativePath(view) {
     }
     return lines;
 }
+// implements REQ-kibi-claim-bound-proofs
+function refutationFields(proof, stages) {
+    const refutations = Array.isArray(proof.claimBindingRejections)
+        ? proof.claimBindingRejections.map((row) => {
+            const entry = asRecord(row);
+            return {
+                test: asString(entry.test),
+                claimKey: asString(entry.claimKey),
+                reason: asString(entry.reason),
+            };
+        })
+        : [];
+    const missing = asStringArray(asRecord(stages.sourceCoordinates).missingSymbols);
+    return {
+        ...(refutations.length > 0 ? { refutations } : {}),
+        ...(missing.length > 0 ? { missingCoordinateSymbols: missing } : {}),
+    };
+}
+/** Why each gap keeps a requirement from being tested end to end. */
+const GAP_REASONS = {
+    missing_passing_e2e: "no scenario-backed test has a passing end-to-end receipt (a test whose verification_scope is not end_to_end does not count)",
+    missing_proof_receipt: "a scenario-backed test has no proof receipt yet",
+    stale_proof_receipt: "a proof receipt is older than the current code",
+    failed_proof_receipt: "a proof receipt records a failed run",
+    invalid_proof_receipt: "a proof receipt cannot be checked",
+    proof_contract_mismatch: "a proof receipt was recorded for an older proof contract",
+    missing_production_symbol: "no production symbol implements the requirement",
+    missing_production_symbol_coverage: "a production symbol is not covered by a qualifying end-to-end test (a test whose verification_scope is not end_to_end does not qualify)",
+    missing_executable_test_symbol: "a scenario test has no test code linked executable_for",
+    missing_scenario: "the requirement has no scenario",
+    missing_scenario_test: "a scenario has no test",
+    happy_path_only: "no scenario exercises the failure side",
+    uncovered_case: "an edge case of the claim has no scenario",
+};
+/** One plain clause per gap, naming what it is about where Kibi knows. */
+// implements REQ-kibi-claim-bound-proofs
+export function gapReason(gap, view) {
+    if (gap === "missing_symbol_coordinates") {
+        const symbols = view.missingCoordinateSymbols ?? [];
+        const named = symbols.length > 0 ? `${symbols.slice(0, 3).join(", ")} ` : "a symbol ";
+        return `${gap}: ${named}${symbols.length > 1 ? "have" : "has"} no source coordinates, so Kibi cannot tie the proof to its code (kibi sync --refresh-symbol-coordinates places ${symbols.length > 1 ? "them" : "it"}; kibi check says why a symbol cannot be placed)`;
+    }
+    const reason = GAP_REASONS[gap];
+    return reason ? `${gap}: ${reason}` : gap;
+}
 function claimFields(proof) {
     const summary = asRecord(proof.claimSummary);
     const count = (key) => typeof summary[key] === "number" ? summary[key] : 0;
@@ -344,6 +390,9 @@ function claimFields(proof) {
                         ...(typeof entry.blocker === "string"
                             ? { blocker: entry.blocker }
                             : {}),
+                        ...(typeof entry.notProved === "string"
+                            ? { notProved: entry.notProved }
+                            : {}),
                         bindings: (Array.isArray(entry.bindings)
                             ? entry.bindings
                             : []).map((raw) => {
@@ -364,6 +413,19 @@ function claimFields(proof) {
             : {}),
     };
 }
+/** Gaps a refuted claim leaves that a derived proof would have covered. */
+const CERTIFIED_GAPS = new Set(["happy_path_only", "uncovered_case"]);
+// implements REQ-kibi-claim-bound-proofs
+function renderRefutations(view) {
+    const refutations = view.refutations ?? [];
+    if (refutations.length === 0)
+        return [];
+    const lines = refutations.map((row) => `refuted: ${row.test} refutes ${row.claimKey}: ${row.reason}. The code breaks the claim, so it is not proved; fix the code (or, with the person who owns the rule, the requirement) and run kibi prove`);
+    const covered = view.proofGaps.filter((gap) => CERTIFIED_GAPS.has(gap));
+    if (covered.length > 0)
+        lines.push(`  ${covered.join(" and ")} ${covered.length > 1 ? "follow" : "follows"} from the refutation: a proof that derives the claim covers its failure side and edge cases, a refuted one covers none`);
+    return lines;
+}
 function renderClaims(view) {
     if (view.claims === undefined)
         return [];
@@ -382,6 +444,9 @@ function renderClaims(view) {
             : `  ${claim.claimKey} not applicable (${claim.status})`);
         for (const binding of claim.bindings)
             lines.push(`    ${binding.test} ${binding.kind}: ${binding.binding}${binding.binding === "derived" ? ` (${binding.scope})` : ""}${binding.reason ? `: ${binding.reason}` : ""}`);
+        // implements REQ-kibi-claim-bound-proofs
+        if (claim.notProved === "requirement_not_tested")
+            lines.push(`    not proved: the certificate derives the claim, but a claim is proved only once the requirement is tested end to end, and it is not (proofStatus ${view.proofStatus})${view.proofGaps.length > 0 ? `: ${view.proofGaps.map((gap) => gapReason(gap, view)).join("; ")}` : ""}`);
     }
     return lines;
 }
@@ -417,6 +482,7 @@ function renderRequirementExplain(view) {
             ? []
             : [`evidenceLevel: ${view.evidenceLevel}`]),
         ...(view.certificateRejections ?? []).map((row) => `certificate rejected for ${row.test}: ${row.reason}`),
+        ...renderRefutations(view),
         ...renderClaims(view),
         "",
         "Scenarios",

package/dist/operations/proof/ingest-proof.d.ts

@@ -24,6 +24,8 @@ export type IngestProofTestResult = Readonly<{
     evidenceLevel?: string;
     /** Why the test's certificate did not re-check, for a certificate kind. */
     certificateRejection?: string;
+    /** The receipt's verification scope (unit, integration or end_to_end). */
+    scope?: string;
 }>;
 export type IngestProofResult = Readonly<{
     artifactDigest: string;

package/dist/operations/proof/ingest-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAoBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AA8nBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}
+{"version":3,"file":"ingest-proof.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/ingest-proof.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,KAAK,QAAQ,EAEd,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAkBjF,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAGlB,MAAM,+BAA+B,CAAC;AAoBvC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;IAC1B,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2EAA2E;IAC3E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAGH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,iBAAiB,EAAE,iBAAiB,CAAC;CACtC,CAAC;AA+nBF,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,iBAAiB,CAAC,CAuC5B"}

package/dist/operations/proof/ingest-proof.js

@@ -328,6 +328,7 @@ async function executeIngestProofUnlocked(args, context, lifecycle) {
             ...(typeof entry.receipt.certificate_rejection === "string"
                 ? { certificateRejection: entry.receipt.certificate_rejection }
                 : {}),
+            scope: entry.receipt.scope,
         },
     ]));
     const pendingCommits = [];

package/dist/operations/proof/java-package-shadow.d.ts

@@ -0,0 +1,14 @@
+interface Row {
+    readonly line: number;
+    readonly text: string;
+}
+/** Java source with comments, string, char and text-block contents removed. */
+export declare function javaCode(text: string): string;
+/**
+ * A filter for one read: keeps every row, except a marked row whose
+ * declaration the project's files rule out. Directory scans are shared by
+ * the files of the read.
+ */
+export declare function createShadowRowFilter(workspaceRoot: string): (file: string, rows: readonly Row[]) => Row[];
+export {};
+//# sourceMappingURL=java-package-shadow.d.ts.map

package/dist/operations/proof/java-package-shadow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java-package-shadow.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/java-package-shadow.ts"],"names":[],"mappings":"AAoDA,UAAU,GAAG;IACX,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAgBD,+EAA+E;AAC/E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CA8B7C;AAmND;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,aAAa,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,EAAE,KAAK,GAAG,EAAE,CAgG1G"}

package/dist/operations/proof/java-package-shadow.js

@@ -0,0 +1,389 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+/**
+ * Names another file of the project may bind instead of the standard one.
+ * The tree-sitter reference reader reads one file at a time, so it marks:
+ *
+ * - a bare Java `System` or `Runtime` ("System may be a class of package
+ *   p: ..."): a top-level type of that name in another file of the package
+ *   would be used instead of java.lang's;
+ * - a bare Rust standard macro ("println may be a macro_rules! macro of the
+ *   crate: ..."): a `macro_rules! println` elsewhere in the crate, in
+ *   textual scope through `#[macro_use]`, would be expanded instead;
+ * - a C# System type spelled bare ("Environment may be a type of the
+ *   project: ..."): a type of that name in the file's namespace, an
+ *   enclosing one or the global namespace, declared in any file of the
+ *   project, or a `global using` alias of that name, would bind instead of
+ *   System's;
+ * - a Go name the file uses but does not declare ("getenv may be declared in
+ *   another file of the package: ..."), for env: another file of the package
+ *   may hold a getter or a wrapper of one;
+ * - a Go name the file calls but does not declare ("command may be a
+ *   function of another file of the package: ..."), for calls: another file
+ *   of the package may bind it to a function value (`var command =
+ *   exec.Command`), so the call is that function's;
+ * - a Go import ("config may be a package of the project: ..."), for env: a
+ *   package of the project may wrap a getter (`config.Get("X")`, `var Get =
+ *   os.Getenv`) or read the environment at init.
+ *
+ * The host drops such a row only after it has looked at those files and
+ * found no such declaration. When it finds one, or cannot read the files,
+ * the row stays and the read is refused.
+ */
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+const JAVA_ROW = /^(System|Runtime) may be a class of (?:package ([\w.]+)|the default package): /;
+const RUST_ROW = /^(\w+) may be a macro_rules! macro of the crate: /;
+const CSHARP_ROW = /^(\w+) may be a type of the project: /;
+const GO_ROW = /^(\w+) may be declared in another file of the package: /;
+const GO_IMPORT_ROW = /^\S+ may be a package of the project: /;
+const GO_CALL_ROW = /^(\w+) may be a function of another file of the package: /;
+/**
+ * What in Go source may read the environment: a getter of os, syscall or
+ * x/sys (also as a value, or through an alias or a dot import), cgo, and a
+ * `//go:linkname`, which binds a local name to any function.
+ */
+const GO_ENV_SOURCE = /\b(?:Getenv|LookupEnv|Environ|ExpandEnv|Expand)\b|"C"|go:linkname/;
+/** Java source with comments, string, char and text-block contents removed. */
+export function javaCode(text) {
+    let out = "";
+    let index = 0;
+    while (index < text.length) {
+        const rest = text.slice(index, index + 3);
+        if (rest.startsWith("//")) {
+            const end = text.indexOf("\n", index);
+            index = end === -1 ? text.length : end;
+            out += " ";
+        }
+        else if (rest.startsWith("/*")) {
+            const end = text.indexOf("*/", index + 2);
+            index = end === -1 ? text.length : end + 2;
+            out += " ";
+        }
+        else if (rest === '"""') {
+            const end = text.indexOf('"""', index + 3);
+            index = end === -1 ? text.length : end + 3;
+            out += '""';
+        }
+        else if (rest[0] === '"' || rest[0] === "'") {
+            const quote = rest[0];
+            index += 1;
+            while (index < text.length && text[index] !== quote && text[index] !== "\n")
+                index += text[index] === "\\" ? 2 : 1;
+            index += 1;
+            out += `${quote}${quote}`;
+        }
+        else {
+            out += text[index];
+            index += 1;
+        }
+    }
+    return out;
+}
+/**
+ * Java source with its Unicode escapes decoded (`q` is `q`), as the
+ * compiler reads it before anything else; a backslash escaped by another
+ * starts no escape.
+ */
+function javaUnicode(text) {
+    return text.replace(/(\\+)u+([0-9a-fA-F]{4})/g, (escape, slashes, hex) => slashes.length % 2 === 1 ? `${slashes.slice(1)}${String.fromCharCode(Number.parseInt(hex, 16))}` : escape);
+}
+/** The package a Java file declares, "" for the default package. */
+function javaPackage(text) {
+    const declared = /\bpackage\s+([\w$.\s]+?)\s*;/.exec(javaCode(javaUnicode(text)));
+    return declared === null ? "" : declared[1].replace(/\s+/g, "");
+}
+/** Whether Java source declares a type of that name (any nesting). */
+function javaDeclares(text, name) {
+    // A Unicode escape may spell any identifier: the file is not ruled out.
+    if (text.includes("\\u"))
+        return true;
+    return new RegExp(`(?:^|[^\\w$.])(?:class|interface|enum|record)\\s+${name}(?![\\w$])`).test(javaCode(text));
+}
+/**
+ * Source files with an extension under a directory, skipping dot folders,
+ * node_modules and the named build folders.
+ */
+function sourceFiles(directory, extension, skipped = []) {
+    const files = [];
+    for (const entry of readdirSync(directory, { withFileTypes: true })) {
+        if (entry.name.startsWith(".") || entry.name === "node_modules" || skipped.includes(entry.name))
+            continue;
+        const full = path.join(directory, entry.name);
+        if (entry.isDirectory())
+            files.push(...sourceFiles(full, extension, skipped));
+        else if (entry.name.endsWith(extension))
+            files.push(full);
+    }
+    return files;
+}
+/**
+ * Whether C# source may declare a type, namespace or `global using` alias of
+ * that name. Comments and strings are not stripped (a mention there keeps
+ * the row too), and an identifier spelled with a Unicode escape may be any
+ * name.
+ */
+function csharpDeclares(text, name) {
+    const id = `@?${name}(?![\\w\\\\])`;
+    return (new RegExp(`\\b(?:class|struct|interface|enum|record)\\s+(?:(?:class|struct)\\s+)?${id}`).test(text) ||
+        new RegExp(`\\bdelegate\\s+[^;{}()]*?[\\s>\\]?]${id}\\s*[<(]`).test(text) ||
+        new RegExp(`\\bnamespace\\s+(?:[\\w@]+\\s*\\.\\s*)*${id}`).test(text) ||
+        new RegExp(`\\bglobal\\s+using\\s+${id}\\s*=`).test(text) ||
+        /\b(?:class|struct|interface|enum|record|delegate)\b[^;{}]*?\\[uU]/.test(text));
+}
+/** Go string literals, interpreted and raw: every import path a file may spell. */
+function goStrings(text) {
+    return [...text.matchAll(/"((?:[^"\\\n]|\\.)*)"|`([^`]*)`/g)].map((match) => match[1] ?? match[2] ?? "");
+}
+/**
+ * The project's Go modules: each go.mod's module path at its folder (which
+ * covers the modules of a go.work), and each replace with a local folder.
+ */
+function goModules(workspaceRoot) {
+    const modules = [];
+    for (const file of sourceFiles(workspaceRoot, "go.mod", ["vendor"])) {
+        if (path.basename(file) !== "go.mod")
+            continue;
+        const dir = path.dirname(file);
+        const text = readFileSync(file, "utf8").replace(/\/\/[^\n]*/g, "");
+        const name = /^\s*module\s+"?([^\s"]+)"?/m.exec(text);
+        if (name !== null)
+            modules.push({ path: name[1], dir });
+        // `replace a v1 => ../a`, alone or in a `replace ( ... )` block.
+        for (const replace of text.matchAll(/^\s*(?:replace\s+)?"?([^\s"(]+)"?(?:\s+\S+)?\s*=>\s*"?((?:\.\.?|\/)[^\s"]*)"?/gm))
+            modules.push({ path: replace[1], dir: path.resolve(dir, replace[2]) });
+    }
+    return modules;
+}
+/** Whether a go.mod at or above `directory`, within the workspace, puts it in module mode. */
+function goModuleMode(workspaceRoot, directory) {
+    for (let current = directory;; current = path.dirname(current)) {
+        try {
+            if (statSync(path.join(current, "go.mod")).isFile())
+                return true;
+        }
+        catch {
+            // no go.mod here
+        }
+        if (path.relative(workspaceRoot, current) === "" || path.dirname(current) === current)
+            return false;
+    }
+}
+/**
+ * Which Go packages are the project's, and whether one can read the
+ * environment. Folder scans and go.mod files are read once per filter.
+ */
+function createGoReach(workspaceRoot) {
+    let modules;
+    const reached = new Map();
+    /**
+     * The folder an import path names when it is the project's: relative,
+     * under a module path or local replace of the project (the longest
+     * wins), or, without a go.mod (GOPATH mode), that path under one of the
+     * importer's enclosing folders. Null for another package (the standard
+     * library's, a third-party one); "" when the project's go.mod files
+     * cannot be read.
+     */
+    const resolve = (spelled, from) => {
+        if (/^\.\.?(?:\/|$)/.test(spelled))
+            return path.resolve(from, spelled);
+        if (goModuleMode(workspaceRoot, from)) {
+            if (modules === undefined) {
+                try {
+                    modules = goModules(workspaceRoot);
+                }
+                catch {
+                    modules = null;
+                }
+            }
+            if (modules === null)
+                return "";
+            let best = null;
+            for (const module of modules)
+                if ((spelled === module.path || spelled.startsWith(`${module.path}/`)) &&
+                    (best === null || module.path.length > best.path.length))
+                    best = module;
+            return best === null ? null : path.join(best.dir, spelled.slice(best.path.length));
+        }
+        for (let current = from;; current = path.dirname(current)) {
+            const candidate = path.join(current, spelled);
+            try {
+                if (statSync(candidate).isDirectory())
+                    return candidate;
+            }
+            catch {
+                // not here
+            }
+            if (path.relative(workspaceRoot, current) === "" || path.dirname(current) === current)
+                return null;
+        }
+    };
+    /**
+     * Whether a package of the project can read the environment: one of its
+     * files (not its tests, which an importer does not compile) spells a
+     * getter, cgo or a linkname, or imports a package of the project that
+     * can. A folder that cannot be read, or holds no Go file, can.
+     */
+    const reaches = (dir) => {
+        const known = reached.get(dir);
+        if (known !== undefined)
+            return known;
+        // An import cycle reads nothing by itself.
+        reached.set(dir, false);
+        let result;
+        try {
+            const texts = readdirSync(dir)
+                .filter((name) => name.endsWith(".go") && !name.endsWith("_test.go"))
+                .map((name) => readFileSync(path.join(dir, name), "utf8"));
+            result = texts.some((text) => GO_ENV_SOURCE.test(text) || importsReach(text, dir));
+        }
+        catch (error) {
+            // No such folder: no package of the project, so the path is not an
+            // import of it (an import of it would not build), only a string.
+            const code = error.code;
+            result = code !== "ENOENT" && code !== "ENOTDIR";
+        }
+        reached.set(dir, result);
+        return result;
+    };
+    /** Whether Go source imports a package of the project that can read the environment. */
+    const importsReach = (text, from) => goStrings(text).some((spelled) => {
+        const target = resolve(spelled, from);
+        return target === "" || (target !== null && target !== from && reaches(target));
+    });
+    return { importsReach };
+}
+/** The nearest folder holding Cargo.toml at or above `directory`, within the workspace. */
+function crateRoot(workspaceRoot, directory) {
+    for (let current = directory;; current = path.dirname(current)) {
+        try {
+            if (statSync(path.join(current, "Cargo.toml")).isFile())
+                return current;
+        }
+        catch {
+            // no manifest here
+        }
+        if (path.relative(workspaceRoot, current) === "" || path.dirname(current) === current)
+            return workspaceRoot;
+    }
+}
+/**
+ * Whether Rust source may define a macro of that name for the crate: a
+ * `macro_rules!` of it (comments allowed between the tokens), a
+ * `macro_rules!` whose name is a macro variable, or `#[macro_use] extern
+ * crate`, which brings another crate's macros in.
+ */
+function rustDefines(text, name) {
+    const gap = String.raw `(?:\s|\/\*[\s\S]*?\*\/|\/\/[^\n]*)*`;
+    return (new RegExp(`macro_rules${gap}!${gap}(?:r#)?${name}(?!\\w)`).test(text) ||
+        new RegExp(`macro_rules${gap}!${gap}\\$`).test(text) ||
+        new RegExp(`#${gap}\\[${gap}macro_use${gap}\\]${gap}(?:pub${gap})?extern${gap}crate\\b`).test(text));
+}
+/**
+ * A filter for one read: keeps every row, except a marked row whose
+ * declaration the project's files rule out. Directory scans are shared by
+ * the files of the read.
+ */
+export function createShadowRowFilter(workspaceRoot) {
+    const sources = new Map();
+    const read = (key, list) => {
+        if (!sources.has(key)) {
+            try {
+                sources.set(key, list().map((file) => readFileSync(file, "utf8")));
+            }
+            catch {
+                sources.set(key, null);
+            }
+        }
+        return sources.get(key) ?? null;
+    };
+    const go = createGoReach(workspaceRoot);
+    return (file, rows) => {
+        const directory = path.dirname(path.join(workspaceRoot, file));
+        return rows.filter((row) => {
+            const java = JAVA_ROW.exec(row.text);
+            if (java !== null) {
+                const texts = read(`java:${directory}`, () => readdirSync(directory)
+                    .filter((name) => name.endsWith(".java"))
+                    .map((name) => path.join(directory, name)));
+                const type = java[1];
+                if (texts === null || texts.some((text) => javaDeclares(text, type)))
+                    return true;
+                // A package spans source roots (src/main/java beside generated or
+                // test sources), and a file's package is what it declares, not its
+                // folder: every .java file of the project declaring the package is
+                // read too.
+                const all = read("java:*", () => sourceFiles(workspaceRoot, ".java"));
+                const pkg = java[2] ?? "";
+                return all === null || all.some((text) => javaPackage(text) === pkg && javaDeclares(text, type));
+            }
+            const rust = RUST_ROW.exec(row.text);
+            if (rust !== null) {
+                const root = crateRoot(workspaceRoot, directory);
+                const texts = read(`rust:${root}`, () => sourceFiles(root, ".rs", ["target"]));
+                return texts === null || texts.some((text) => rustDefines(text, rust[1]));
+            }
+            if (GO_IMPORT_ROW.test(row.text)) {
+                // The row's text may be cut short, so the import is read from the
+                // file's line; every path spelled there is checked.
+                const texts = read(`file:${file}`, () => [path.join(workspaceRoot, file)]);
+                const line = texts?.[0]?.split("\n")[row.line - 1];
+                return line === undefined || goStrings(line).length === 0 || go.importsReach(line, directory);
+            }
+            const goCall = GO_CALL_ROW.exec(row.text);
+            if (goCall !== null) {
+                const own = path.basename(file);
+                const test = own.endsWith("_test.go");
+                const texts = read(`go:${file}`, () => readdirSync(directory)
+                    .filter((name) => name.endsWith(".go") && name !== own && (test || !name.endsWith("_test.go")))
+                    .map((name) => path.join(directory, name)));
+                // A function declared in another file is the package's own function;
+                // a variable of that name may hold any function value.
+                const name = goCall[1];
+                const variable = new RegExp(`\\bvar\\s+${name}\\b|\\b${name}\\s*(?:,\\s*\\w+\\s*)*(?::=|=(?!=))|^\\s*${name}\\s+[^\\s(=]`, "m");
+                return texts === null || texts.some((text) => variable.test(javaCode(text)));
+            }
+            const goName = GO_ROW.exec(row.text);
+            if (goName !== null) {
+                // The package's other files: the directory's .go files, with its
+                // test files only for a test file.
+                const own = path.basename(file);
+                const test = own.endsWith("_test.go");
+                const texts = read(`go:${file}`, () => readdirSync(directory)
+                    .filter((name) => name.endsWith(".go") && name !== own && (test || !name.endsWith("_test.go")))
+                    .map((name) => path.join(directory, name)));
+                // A getter may be reached through the name by any chain of the
+                // package's functions and values, so the row stays when any of
+                // those files can read the environment and any names it.
+                // A file that imports a package of the project that can read the
+                // environment can read it too.
+                const name = new RegExp(`\\b${goName[1]}\\b`);
+                return (texts === null ||
+                    (texts.some((text) => GO_ENV_SOURCE.test(text) || go.importsReach(text, directory)) &&
+                        texts.some((text) => name.test(text))));
+            }
+            const csharp = CSHARP_ROW.exec(row.text);
+            if (csharp !== null) {
+                // Generated sources under obj/ are compiled too, so they are read.
+                const texts = read("csharp", () => sourceFiles(workspaceRoot, ".cs"));
+                return texts === null || texts.some((text) => csharpDeclares(text, csharp[1]));
+            }
+            return true;
+        });
+    };
+}

package/dist/operations/proof/prolog-evaluator.d.ts

@@ -0,0 +1,14 @@
+/**
+ * The SWI-Prolog evaluator behind the code proof kinds. Kibi runs it with the
+ * SWI-Prolog it resolves for its own engine (KIBI_SWIPL, the bundled runtime,
+ * then swipl on PATH). It loads the file a symbol names (a module, or a plain
+ * file into user) and reads a predicate named by its indicator: a domain is
+ * the distinct solutions of one argument (`arg`, or the only one), a value is
+ * the single number such a solution holds, a rule predicate is called once
+ * per row and decides it by success or failure, and a transition table lists
+ * every solution as an edge. The plan is the last command-line argument; the
+ * answer is the last line of output, in the JSON the JavaScript and Python
+ * evaluators print.
+ */
+export declare const PROLOG_EVALUATOR: string;
+//# sourceMappingURL=prolog-evaluator.d.ts.map

package/dist/operations/proof/prolog-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prolog-evaluator.d.ts","sourceRoot":"","sources":["../../../src/operations/proof/prolog-evaluator.ts"],"names":[],"mappings":"AAkBA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,gBAAgB,QAwN5B,CAAC"}