Oska checker report

oskac check <file.osk> [--format=json] [--release] type-checks one file against the embedded prelude. The rules it enforces are in the "Type checking" section of design.md. This page describes what it prints. The codes oskac run reports, its refusals and panics (P-codes), are in runtime.md.

The exit code is non-zero when there are diagnostics. Without --format=json, diagnostics go to stderr and the authority report to stdout, one function per line, such as fn main: Stdout (io), FsRead (fs) or fn add: pure. Each function's attenuations follow it, indented, such as FsRead -> DirRead: restrict_to "docs" (bytes 88..112). One line per audit site comes last, such as audit: assume_trusted (bytes 52..73).

An attenuation is a call of one of the prelude's attenuation methods (restrict_to, restrict_to_file, read_only, write_only) on a built-in capability. The report lists each one under the function it is in (a closure's belong to the function around it), with the capability kind it narrows from and to, and its root:

• restrict_to "docs" has a literal root: a string literal, a module constant holding one, or Path.new of either. Narrowing a directory capability gives the path relative to its own root, as written.
• restrict_to computed at runtime has any other root: a variable, an interpolated string, Path.from(untrusted). In JSON its root is null.
• read_only and write_only take no root, so they show none.

A method called qualified by its type is listed the same way: FsRead.restrict_to(read, "/etc") is FsRead -> DirRead: restrict_to "/etc". A method taken as a function value, as in let narrow = FsRead.restrict_to, is listed where it is named, with its root computed at runtime. Audit sites follow the same rule: String.assume_trusted(text) and let vouch = String.assume_trusted are each a trust assertion.

A reviewer reads a program's filesystem reach straight from these lines: FsRead -> DirRead: restrict_to "docs" and FsWrite -> DirWrite: restrict_to "_site" mean the program reads docs and writes _site. Whole-filesystem access shows as restrict_to "/".

Type and trait names in signatures and declarations are resolved, declarations are checked (cap, main, capitalization, recursive types, and where a Scope may appear), functions, methods, and impls are checked for duplicates, and under --release every body is scanned for dbg(...) and todo(). A use must name a std.* module that exists (E0294, E0295); see std modules for which do. Function, method, constant, and test bodies are type-checked with local, bidirectional inference: let types come from initializers, the expected type flows into literals, generic constructors, and closures, and an expression that fails gets an error type so it causes only one diagnostic.

Text carries a trust flag (ADR 0006). Untrusted<String> is untrusted text; plain String is trusted. Text from outside the program is untrusted: DirRead.read_to_string, FileRead.read_to_string, Stdin.read_line, Env.get, and Args.get return it. Trusted text may be used wherever untrusted text is accepted, so a data position such as Stdout.println or Path.from takes both; untrusted text is never accepted where trusted String is required (E0300). A validator vouches for text it has checked with .assume_trusted(), which returns trusted String; each call is a trust assertion, listed in the report's audit array. Untrusted<...> marks text only (E0320).

Env.secret returns a Secret<String>, which code cannot construct itself (E0271). A secret cannot be interpolated, nor can a value that holds one (E0350). It is not Eq, so == and != on one are errors (E0351); compare it with .constant_time_eq(text), which takes trusted or untrusted text, or with another secret through .constant_time_eq_secret(other), which exposes neither. It is not Display, so it cannot be printed (E0352). The only way to read its value is .expose(), which returns trusted text; each call is a secret exposure, listed in the report's audit array.

Untrusted-ness carries through every route. Prelude text operations are trust-polymorphic: the prelude marks each with #[follows_trust], an attribute only the prelude may write. Each call gets a fresh trust variable that its receiver and text arguments join into, and every text type in its result has that trust, so untrusted.trim() and untrusted.lines() are untrusted while untrusted.len() and untrusted.contains("x") are trusted Int and Bool. Any other function's receiver is checked like an argument. An interpolated string is untrusted when text in any hole is, and every hole must be Display (E0265). Inside a generic body, text that comes from a type parameter is untrusted: interpolating a T, and the text result of a call on a T receiver or with a T argument. A generic function or trait method also follows the trust of its type arguments at each call: when the result holds a fixed String and what any generic (or Self, in a qualified trait call) is instantiated with holds untrusted text, that text in the result is untrusted, so fn show<T: Display>(x: T) -> String cannot launder an untrusted x. An impl method may return trusted text where its trait declares Untrusted<String>. The message of IoError, SqlError, and ProcError is untrusted, and so is their text: a struct or enum holds untrusted text when a field is untrusted text or a type that holds it, at any depth, and such a value turns into untrusted text wherever it becomes text. That covers interpolating it, a generic's type argument, Self in a qualified trait call such as Display.to_string(e), and a method of a prelude or std type, such as e.to_string() or IoError.to_string(e), whose body the checker cannot see. A method the module declares is checked against its own signature, so its to_string(self) -> String cannot return self.cause.to_string() for an IoError field without .assume_trusted(). == and != compare text of either trust, and a trait impl for String covers both. Where values meet, trusted and untrusted text join to untrusted rather than conflicting: if and match branches, the arguments of a generic function for one type parameter, and the elements of a list. Inference variables are solved to trust variables, and the checker keeps every flow between them, so text that has already been used where trusted String is required rejects untrusted text that arrives later, as with names.push(arg) after greet(names.get(0)?). A mutating (var self) method's receiver takes back what the method writes into it, so names.push(arg) on a var names: List<String> rejects untrusted arg too.

Contract clauses are type-checked here, and evaluated by the runtime on every call (P0006, P0007: see the runtime reference). requires and ensures conditions must be Bool (E0281), they see the parameters (and self), ensures |r| binds r to the return type, and a contract may call only pure functions (E0280). That covers what an operator dispatches to as well: == and != call an Eq impl, an interpolation hole calls a Display impl, and a ? inside a closure may call a From impl, so each is judged as a call with the operands' types. A ? or return directly in a clause is an error (E0282), because a condition has no function to leave. A trait method's contract is checked even without a body, and it binds every impl of the method: a method of impl Trait for Type declares no contract of its own (E0218), and neither does main (E0219), which nothing calls.

Inside a generic body a type parameter is never capability-bearing and never holds a Scope, because nothing is known about it. Three things rely on that, so each records what it assumes of the type parameter, and every instantiation of the parameter must keep it (E0274):

• A contract that uses a value of type T, by calling a method on it, passing it on, comparing it, or interpolating it, assumes T is not capability-bearing: otherwise the contract could perform an effect.
• A closure that captures a value of type T (or one holding a T, such as an Option<T> or a closure that captured one) and is used as a plain fn, by flowing into a plain fn slot or being called in a contract, assumes the same: otherwise a plain fn would carry authority. A closure used only where a cap fn is accepted, such as spawn's task, assumes nothing.
• A closure that captures a value of type T and is not scoped assumes T holds no Scope handle: otherwise the closure could outlive the handle's scope block. This is conservative: it holds even for a closure that never leaves its body.

A trait's Self is a type parameter too, so a trait whose contract uses self, or whose default method keeps self in a plain fn, cannot be implemented for a capability-bearing type. The assumption is checked at a call of a generic function or method (for its own generics and its impl's), where a bound is satisfied through a generic impl, and at an impl of the trait. A generic that instantiates another with its own parameter passes the assumption on, so fn outer<U: Speak>(x: U) -> Int { check(x) } cannot be called with a Stdout either when check's contract calls x.ok().

A test body sees one built-in value, t, of the prelude type TestContext. Its fields are stand-in capabilities: t.fs (an in-memory Fs), t.clock (a fixed Clock), t.random (a seeded Random), and t.stdout (a recording Stdout). Its methods are the assertions t.assert(cond), t.assert_eq(actual, expected), t.assert_ne(actual, other), and t.fail(message), and t.printed() returns the lines printed to t.stdout. An #[integration] test gets the same t; the runtime decides which capabilities are real. A test produces no value, so its last expression is a statement like the others.

Report

{
  "diagnostics": [
    {"code":"E0200","message":"unknown type `Strng`; did you mean `String`?","span":{"start":8,"end":13},"fix":{"message":"replace with `String`","edits":[{"span":{"start":8,"end":13},"replacement":"String"}]}}
  ],
  "functions": [
    {"name":"count_lines","authority":["FsRead"],"via":[{"param":"fs","capabilities":["FsRead"]}],"pure":false},
    {"name":"Logger.log","authority":["Stdout"],"via":[{"param":"self","capabilities":["Stdout"]}],"pure":false},
    {"name":"add","authority":[],"via":[],"pure":true}
  ],
  "audit": [
    {"kind":"assume_trusted","span":{"start":412,"end":430}}
  ],
  "attenuations": [
    {"function":"count_lines","method":"restrict_to","span":{"start":150,"end":176},"source":"FsRead","result":"DirRead","root":"docs"}
  ]
}

• diagnostics, in source order. Each uses the same object as parser diagnostics (see ast.md): code, message, span (byte offsets), and fix when the repair is unambiguous. A parse error is reported alone, with empty functions, audit and attenuations.
• functions: one entry per function and impl method, in source order. The report is produced even when there are diagnostics.
  • name: the function's name, or Type.method for a method.
  • authority: the built-in capabilities the function can reach, in order of first appearance, without repeats. cap types are expanded through their fields, and type arguments are expanded, so List<Stdout> reaches Stdout. Each capability is reported by its own name: an attenuation to a directory shows as the directory capability it gives, such as DirRead.
  • via: each capability-bearing parameter and the capabilities it supplies, in parameter order. A method's receiver appears as self. A cap fn parameter is listed with no capabilities, because a closure's capabilities are not written in its type; it still makes the function impure.
  • pure: true when no parameter, the receiver included, is capability-bearing.
• audit: every audit site, in source order. It is always present, and is [] when there are none.
  • kind: what the call does. assume_trusted is a trust assertion: .assume_trusted() turns untrusted text into trusted text, as a validator does. expose is a secret exposure: .expose() reads a Secret's value.
  • span: the whole call expression, such as s.assume_trusted().
• attenuations: every call that narrows a capability, in source order. It is always present, and is [] when there are none. The entries come from the prelude's attenuation methods, so a new capability kind with such a method appears with no change to the checker.
  • function: the function the call is in, named as in functions.
  • method: restrict_to, restrict_to_file, read_only or write_only.
  • source and result: the capability kinds before and after, such as FsRead and DirRead.
  • root: the root as a string when it is a literal or a module constant, and null when it is computed at runtime or the method takes none (read_only, write_only). The human report tells the two apart.
  • span: the whole call expression, such as read.restrict_to("docs").

The prelude

The prelude is Oska source, crates/oska-check/src/prelude.osk, parsed with parse_prelude. It declares the built-in capabilities as #[capability] structs with private fields, the core types (Option, Result, List, Range, Path, Args, IoError) with the few methods the examples and tests use, structured concurrency (Scope, whose spawn(task: cap fn() -> T) returns a Task<T>, whose join() returns T; scope |s| { ... } binds s: Scope), the dbg and todo functions, TestContext (the type of t in tests), and the core traits (Eq, Hash, Display, From). The primitive types (Int, I8 to I64, U8 to U64, Bool, String) and () are built into the checker. The prelude implements Display for String, Int, and IoError. User code cannot redeclare any of these names.

std modules

A std.* module is also prelude-mode Oska source, crates/oska-check/src/std/<name>.osk, registered in STD_MODULES in src/prelude.rs. Its declarations are in scope only in a module that imports it. use std.sql imports the module: code reaches its exports qualified, as types and as values (sql.Db, sql.connect(...), sql.Db.query), and writing one unqualified is E0340. use std.sql.{Db, connect} imports those names unqualified and does not bind sql. There are no glob imports. A brace group or a qualified path may only name what the module exports (E0312). Without the use, its names are unknown (E0200). A local variable shadows a module name. A name the module declares but does not export is private to it (E0360). The user module may declare a name that an imported module also declares, as long as it is not imported unqualified: after use std.sql, a user struct Row is Row, and the module's is sql.Row. The modules that exist are:

A sink literal's tag names the module that provides it. The literal has the type that module declares for it, and the module must be imported (E0310). A tag no module provides is E0311. The sink modules are signature-only. std.html has a runtime: text escapes &, <, >, ", and ', so its output is safe in an element's content and in a quoted attribute value, and TrustedHtml markup passes through unescaped. std.sql and std.proc have none yet.

Each sink separates a data position, declared Untrusted<String>, from a structural position, declared String or a sink literal type. Untrusted text in a String structural position is E0300; any text where a sink literal is required is E0341.

Values that come back from a sink are untrusted: Row.get, Output.stdout, Html.render, and Connection.receive. Db and Connection are capability-bearing (Db holds a NetConnect), and every sink type except the error types has private fields, so code outside the module can't construct one (E0271).

Syntax diagnostic codes

The lexer and the parser report these. A syntax error is the only diagnostic of a file: nothing past it is parsed, so oskac check reports no checker code beside it. A file that parses reaches the checker, and its codes are in the checker table below. Each code below has a failing example and its fix, as the checker codes do (see Examples).

Syntax examples

Each code has a program that fails with exactly that code and the same program fixed. E0170 has no example: the checker reports it only for the prelude, and user code gets E0132 instead, so no program can reach it.

E0001

fn main() {
    let x = $
}

fn main() {
    let x = 1
}

E0002

fn main() {
    let greeting = "hello
}

fn main() {
    let greeting = "hello"
}

E0003

fn main() {
    let path = "C:\data"
}

fn main() {
    let path = "C:\\data"
}

E0004

use std.sql

fn main() {
    let query = sql"SELECT {id}"
}

use std.sql

fn main() {
    let query = sql"SELECT 1"
}

E0005

fn main() {
    let x = 1;
}

fn main() {
    let x = 1
}

E0100

fn main() {
    let x = )
}

fn main() {
    let x = 1
}

E0101

fn first() {} fn second() {}

fn first() {}
fn second() {}

E0102

fn main() {
    let n = 1
    let text = "next is {n + 1}"
}

fn main() {
    let n = 1
    let next = n + 1
    let text = "next is {next}"
}

E0103

fn main() {
    {
        let x = 1
    }
}

fn main() {
    let x = 1
}

E0104

fn main() {
    let x
}

fn main() {
    let x = 0
}

E0105

fn main() {
    let a = 1
    let ok = 0 < a < 3
}

fn main() {
    let a = 1
    let ok = 0 < a && a < 3
}

E0106

fn main() {
    var x = 1
    x + 1 = 2
}

fn main() {
    var x = 1
    x = 2
}

E0107

let x = 1

fn main() {}

fn main() {
    let x = 1
}

E0110

fn double(n: Int) -> Int
    ensures r > 0
{
    n * 2
}

fn double(n: Int) -> Int
    ensures |r| r > 0
{
    n * 2
}

E0111

struct Counter { count: Int }

impl Counter {
    fn add(n: Int, self) -> Int {
        self.count + n
    }
}

struct Counter { count: Int }

impl Counter {
    fn add(self, n: Int) -> Int {
        self.count + n
    }
}

E0112

fn bump(var n: Int) -> Int {
    n + 1
}

fn bump(n: Int) -> Int {
    n + 1
}

E0113

fn same<T>(a: T, b: T) -> Bool where T: Eq {
    a == b
}

fn same<T: Eq>(a: T, b: T) -> Bool {
    a == b
}

E0120

struct Point {
    x: Int
    y: Int
}

struct Point {
    x: Int,
    y: Int
}

E0130

use std.html.*

fn main() {}

use std.html.{text}

fn main() {}

E0131

use std.html.text as escape

fn main() {}

use std.html.{text}

fn main() {}

E0132

#[integation]
test "reads a file" {
    t.assert(true)
}

#[integration]
test "reads a file" {
    t.assert(true)
}

E0133

unsafe fn dangerous() {}

fn safe() {}

E0140

fn name(n: Int) -> String {
    match n {
        1 | 2 => "small"
        _ => "big"
    }
}

fn name(n: Int) -> String {
    match n {
        1 => "small"
        2 => "small"
        _ => "big"
    }
}

E0141

fn name(n: Int) -> String {
    match n {
        1..5 => "small"
        _ => "big"
    }
}

fn name(n: Int) -> String {
    match n {
        _ => if n < 5 { "small" } else { "big" }
    }
}

E0142

fn show(x: Option<Int>) -> Int {
    match x {
        v @ Some(_) => 1
        None => 0
    }
}

fn show(x: Option<Int>) -> Int {
    match x {
        Some(_) => 1
        None => 0
    }
}

E0143

fn show(x: Option<Int>) -> Int {
    match x {
        Some(_) => 1,
        None => 0
    }
}

fn show(x: Option<Int>) -> Int {
    match x {
        Some(_) => 1
        None => 0
    }
}

E0150

fn size(self) -> Int {
    1
}

struct Box { n: Int }

impl Box {
    fn size(self) -> Int {
        1
    }
}

E0151

struct Box { n: Int }

pub impl Box {
    fn size(self) -> Int {
        1
    }
}

struct Box { n: Int }

impl Box {
    pub fn size(self) -> Int {
        1
    }
}

E0160

fn greet(name: String) -> Int {
    match name {
        "hi {name}" => 1
        _ => 0
    }
}

fn greet(name: String) -> Int {
    match name {
        "hi" => 1
        _ => 0
    }
}

E0161

test "adds {n}" {
    t.assert(true)
}

test "adds" {
    t.assert(true)
}

E0162

trait Show {
    pub fn show(self) -> String
}

trait Show {
    fn show(self) -> String
}

E0163

pub test "adds" {
    t.assert(true)
}

test "adds" {
    t.assert(true)
}

E0164

pub use std.html

fn main() {}

use std.html

fn main() {}

E0165

#[integration]
fn setup() {}

#[integration]
test "setup" {
    t.assert(true)
}

Diagnostic codes

Checker examples

Each code has a program that fails with exactly that code and the same program fixed. E0360 has no example: no std module declares a private name yet, so no program can reach it.

E0200

fn greet(name: Strng) {}

fn greet(name: String) {}

E0201

fn show(x: Display) {}

fn show<T: Display>(x: T) {}

E0202

fn helper() {}

fn helper() {}

fn helper() {}

fn other_helper() {}

E0210

struct Logger { out: Stdout }

cap struct Logger { out: Stdout }

E0211

fn main(count: Int) {}

fn main(io: Stdout) {}

E0212

fn main() -> Int {
    0
}

fn main() {}

E0213

struct point { x: Int }

struct Point { x: Int }

E0214

fn Double(n: Int) -> Int {
    n * 2
}

fn double(n: Int) -> Int {
    n * 2
}

E0215

struct Loop { me: Loop }

struct Node { next: Option<Node> }

E0216

fn main() {
    let x = dbg(1)
}

fn main() {
    let x = 1
}

E0217

fn main(docs: DirRead) {}

fn main(fs: FsRead) {
    let docs = fs.restrict_to("docs")
}

E0218

trait Shape {
    fn size(self) -> Int
}

struct Square { side: Int }

impl Shape for Square {
    fn size(self) -> Int
        ensures |r| r > 0
    {
        self.side
    }
}

trait Shape {
    fn size(self) -> Int
        ensures |r| r > 0
}

struct Square { side: Int }

impl Shape for Square {
    fn size(self) -> Int {
        self.side
    }
}

E0219

fn main()
    requires 1 > 0
{
}

fn main() {
    let ready = 1 > 0
}

E0220

fn main() {
    let x: Int = "one"
}

fn main() {
    let x: Int = 1
}

E0221

fn main() {
    let count = 1
    let total = cuont + 1
}

fn main() {
    let count = 1
    let total = count + 1
}

E0222

fn main() {
    let x: U8 = 300
}

fn main() {
    let x: U8 = 200
}

E0223

fn main() {
    let text = "a" + "b"
}

fn main() {
    let a = "a"
    let b = "b"
    let text = "{a}{b}"
}

E0224

fn add(a: Int, b: Int) -> Int {
    a + b
}

fn main() {
    let n = add(1)
}

fn add(a: Int, b: Int) -> Int {
    a + b
}

fn main() {
    let n = add(1, 2)
}

E0225

fn add(a: Int, b: Int) -> Int {
    a + b
}

fn main() {
    let n = add(x: 1, b: 2)
}

fn add(a: Int, b: Int) -> Int {
    a + b
}

fn main() {
    let n = add(a: 1, b: 2)
}

E0226

struct Point { x: Int, y: Int }

fn main() {
    let p = Point(1, 2)
}

struct Point { x: Int, y: Int }

fn main() {
    let p = Point(x: 1, y: 2)
}

E0227

struct Point { x: Int, y: Int }

fn main() {
    let p = Point(x: 1, y: 2)
    let z = p.z
}

struct Point { x: Int, y: Int }

fn main() {
    let p = Point(x: 1, y: 2)
    let z = p.x
}

E0228

fn main() {
    let t = "  hi ".trimm()
}

fn main() {
    let t = "  hi ".trim()
}

E0229

fn main() {
    let x = 1
    x = 2
}

fn main() {
    var x = 1
    x = 2
}

E0230

struct Counter { count: Int }

impl Counter {
    fn tick(var self) {
        self.count = self.count + 1
    }
}

fn main() {
    let c = Counter(count: 0)
    c.tick()
}

struct Counter { count: Int }

impl Counter {
    fn tick(var self) {
        self.count = self.count + 1
    }
}

fn main() {
    var c = Counter(count: 0)
    c.tick()
}

E0231

fn main() {
    let x = 1
    x()
}

fn main() {
    let f = || 1
    let y = f()
}

E0232

fn main() {
    break
}

fn main() {
    while true {
        break
    }
}

E0233

fn main() {
    let xs = List.new()
}

fn main() {
    let xs: List<Int> = List.new()
}

E0234

fn main() {
    let x = Int
}

fn main() {
    let x = 1
}

E0235

fn main() {
    for i in 5 {
        let j = i
    }
}

fn main() {
    for i in 0..5 {
        let j = i
    }
}

E0240

fn main(io: Stdout) -> Result<(), IoError> {
    io.println("hi")
    Ok(())
}

fn main(io: Stdout) -> Result<(), IoError> {
    io.println("hi")?
    Ok(())
}

E0241

fn first() -> Option<Int> {
    let n = 1?
    Some(n)
}

fn first() -> Option<Int> {
    let n = 1
    Some(n)
}

E0242

fn parse() -> Result<Int, String> {
    Err("bad")
}

fn run() -> Result<Int, Int> {
    let n = parse()?
    Ok(n)
}

fn parse() -> Result<Int, String> {
    Err("bad")
}

fn run() -> Result<Int, String> {
    let n = parse()?
    Ok(n)
}

E0243

fn double(x: Option<Int>) -> Result<Int, String> {
    let n = x?
    Ok(n * 2)
}

fn double(x: Option<Int>) -> Result<Int, String> {
    let n = x.ok_or("missing")?
    Ok(n * 2)
}

E0250

fn count(x: Option<Int>) -> Int {
    match x {
        Some(n) => n
        Nnoe => 0
    }
}

fn count(x: Option<Int>) -> Int {
    match x {
        Some(n) => n
        None => 0
    }
}

E0251

fn count(x: Option<Int>) -> Int {
    match x {
        Some => 1
        None => 0
    }
}

fn count(x: Option<Int>) -> Int {
    match x {
        Some(_) => 1
        None => 0
    }
}

E0252

enum Shape {
    Circle { radius: Int },
    Empty,
}

fn size(s: Shape) -> Int {
    match s {
        Shape.Circle(r) => r
        Shape.Empty => 0
    }
}

enum Shape {
    Circle { radius: Int },
    Empty,
}

fn size(s: Shape) -> Int {
    match s {
        Shape.Circle(radius: r) => r
        Shape.Empty => 0
    }
}

E0253

fn count(x: Option<Int>) -> Int {
    match x {
        Some(n) => n
    }
}

fn count(x: Option<Int>) -> Int {
    match x {
        Some(n) => n
        None => 0
    }
}

E0254

fn count(x: Option<Int>) -> Int {
    match x {
        _ => 0
        Some(n) => n
    }
}

fn count(x: Option<Int>) -> Int {
    match x {
        Some(n) => n
        _ => 0
    }
}

E0260

trait Measure {
    fn size(self) -> Int
}

fn total<T>(x: T) -> Int {
    x.size()
}

trait Measure {
    fn size(self) -> Int
}

fn total<T: Measure>(x: T) -> Int {
    x.size()
}

E0261

trait Shape {
    fn area(self) -> Int
    fn name(self) -> String
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> Int {
        self.side * self.side
    }
}

trait Shape {
    fn area(self) -> Int
    fn name(self) -> String
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> Int {
        self.side * self.side
    }
    fn name(self) -> String {
        "square"
    }
}

E0262

trait Shape {
    fn area(self) -> Int
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> String {
        "big"
    }
}

trait Shape {
    fn area(self) -> Int
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> Int {
        self.side * self.side
    }
}

E0263

trait Shape {
    fn area(self) -> Int
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> Int {
        self.side * self.side
    }
    fn name(self) -> String {
        "square"
    }
}

trait Shape {
    fn area(self) -> Int
}

struct Square { side: Int }

impl Shape for Square {
    fn area(self) -> Int {
        self.side * self.side
    }
}

impl Square {
    fn name(self) -> String {
        "square"
    }
}

E0264

trait Short {
    fn describe(self) -> String
}

trait Long {
    fn describe(self) -> String
}

struct Cat { name: String }

impl Short for Cat {
    fn describe(self) -> String {
        "cat"
    }
}

impl Long for Cat {
    fn describe(self) -> String {
        "a cat"
    }
}

fn show(c: Cat) -> String {
    c.describe()
}

trait Short {
    fn describe(self) -> String
}

trait Long {
    fn describe(self) -> String
}

struct Cat { name: String }

impl Short for Cat {
    fn describe(self) -> String {
        "cat"
    }
}

impl Long for Cat {
    fn describe(self) -> String {
        "a cat"
    }
}

fn show(c: Cat) -> String {
    Short.describe(c)
}

E0265

struct Point { x: Int }

fn main() {
    let a = Point(x: 1)
    let b = Point(x: 1)
    let same = a == b
}

struct Point { x: Int }

fn main() {
    let a = Point(x: 1)
    let b = Point(x: 1)
    let same = a.x == b.x
}

E0270

fn apply(f: fn()) {
    f()
}

fn main(io: Stdout) {
    apply(|| {
        let _ = io.println("hi")
    })
}

fn apply(f: cap fn()) {
    f()
}

fn main(io: Stdout) {
    apply(|| {
        let _ = io.println("hi")
    })
}

E0271

fn main() {
    let out = Stdout(handle: 1)
}

fn main(out: Stdout) {}

E0272

fn main(out: Stdout) {
    let h = out.handle
}

fn main(out: Stdout) {
    let _ = out.println("hi")
}

E0273

fn count(fs: FsRead, path: Path) -> Result<Int, IoError> {
    Ok(fs.read_to_string(path)?.len())
}

fn count(fs: FsRead, path: Path) -> Result<Int, IoError> {
    Ok(fs.restrict_to("/srv/app").read_to_string(path)?.len())
}

E0274

trait Speak {
    fn ok(self) -> Bool
}

impl Speak for Stdout {
    fn ok(self) -> Bool {
        let _ = self.println("checking")
        true
    }
}

fn check<T: Speak>(x: T) -> Int
    requires x.ok()
{
    1
}

fn main(out: Stdout) {
    let n = check(out)
}

trait Speak {
    fn ok(self) -> Bool
}

impl Speak for Int {
    fn ok(self) -> Bool {
        self > 0
    }
}

fn check<T: Speak>(x: T) -> Int
    requires x.ok()
{
    1
}

fn main(out: Stdout) {
    let n = check(5)
}

E0280

fn ready(io: Stdout) -> Bool {
    true
}

fn run(io: Stdout) -> Int
    requires ready(io)
{
    1
}

fn ready(n: Int) -> Bool {
    n > 0
}

fn run(n: Int) -> Int
    requires ready(n)
{
    1
}

E0281

fn run(n: Int) -> Int
    requires n
{
    n
}

fn run(n: Int) -> Int
    requires n > 0
{
    n
}

E0282

fn first(xs: List<Int>) -> Option<Int> {
    xs.get(0)
}

fn run(xs: List<Int>) -> Int
    requires first(xs)? > 0
{
    1
}

fn run(xs: List<Int>) -> Int
    requires xs.len() > 0
{
    1
}

E0290

struct Box<T> { value: T }

impl<T> Display for Box<T> {
    fn to_string(self) -> String {
        "box"
    }
}

impl Display for Box<Int> {
    fn to_string(self) -> String {
        "int box"
    }
}

struct Box<T> { value: T }

impl<T> Display for Box<T> {
    fn to_string(self) -> String {
        "box"
    }
}

E0291

impl FsRead {
    fn size(self) -> Int {
        1
    }
}

fn size(fs: FsRead) -> Int {
    1
}

E0292

fn leak() -> Scope {
    scope |s| { s }
}

fn work() -> Int {
    1
}

fn run() -> Int {
    scope |s| {
        let task = s.spawn(|| work())
        task.join()
    }
}

E0293

fn main() {
    todo()
}

fn main() {}

E0294

use mylib.helpers

fn main() {}

use std.html

fn main() {}

E0295

use std.htm

fn main() {}

use std.html

fn main() {}

E0300

fn greet(name: String) -> String {
    "Hello, {name}"
}

fn show(user: Untrusted<String>) -> String {
    greet(user)
}

fn greet(name: Untrusted<String>) -> Untrusted<String> {
    "Hello, {name}"
}

fn show(user: Untrusted<String>) -> Untrusted<String> {
    greet(user)
}

E0310

fn main() {
    let query = sql"SELECT 1"
}

use std.sql

fn main() {
    let query = sql"SELECT 1"
}

E0311

use std.sql

fn main() {
    let query = sqll"SELECT 1"
}

use std.sql

fn main() {
    let query = sql"SELECT 1"
}

E0312

use std.sql.{SqlLitreal}

fn main() {}

use std.sql.{SqlLiteral}

fn main() {}

E0320

fn count(n: Untrusted<Int>) {}

fn count(n: Int) {}

E0340

use std.sql

fn run(q: SqlLiteral) {}

use std.sql

fn run(q: sql.SqlLiteral) {}

E0341

use std.sql

fn run(db: sql.Db, id: Untrusted<String>) {
    let rows = db.query("SELECT * FROM users", [id])
}

use std.sql

fn run(db: sql.Db, id: Untrusted<String>) {
    let rows = db.query(sql"SELECT * FROM users WHERE id = ?", [id])
}

E0350

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let header = "Bearer {key}"
}

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let value = key.expose()
    let header = "Bearer {value}"
}

E0351

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let ok = key == "hunter2"
}

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let ok = key.constant_time_eq("hunter2")
}

E0352

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let text = key.to_string()
}

fn main(env: Env) {
    let key = env.secret("API_KEY")
    let text = key.expose()
}