@fairfox/polly 0.91.0 → 0.92.0

package/dist/tools/verify/src/config.d.ts

@@ -200,4 +200,4 @@ type UnifiedVerificationConfig = LegacyVerificationConfig | AdapterVerificationC
  * ```
  */
 export declare function defineVerification<T extends UnifiedVerificationConfig>(config: T): T;
-export { $constraints, ensures, forAllPeers, hasLength, inRange, oneOf, requires, somePeer, stateConstraint, } from "./primitives/index.js";
+export { $constraints, CONTRACT_VIOLATIONS_KEY, type ContractPrimitive, type ContractsMode, ContractViolation, contractsMode, drainContractViolations, ensures, forAllPeers, hasLength, inRange, oneOf, requires, somePeer, stateConstraint, } from "./primitives/index.js";

package/dist/tools/verify/src/config.js

@@ -1,6 +1,67 @@
 // tools/verify/src/primitives/index.ts
-function requires(condition, message) {}
-function ensures(condition, message) {}
+var CONTRACT_VIOLATIONS_KEY = "__pollyContractViolations";
+function readContractsMode() {
+  const v = typeof process !== "undefined" && process.env ? process.env["POLLY_CONTRACTS"] : undefined;
+  return v === "all" || v === "ensures" ? v : "off";
+}
+var MODE = readContractsMode();
+function contractsMode() {
+  return MODE;
+}
+
+class ContractViolation extends Error {
+  primitive;
+  site;
+  contractMessage;
+  name = "ContractViolation";
+  constructor(primitive, site, contractMessage) {
+    super(`[polly-contract ${primitive} ${site}]${contractMessage === undefined ? "" : ` ${contractMessage}`}`);
+    this.primitive = primitive;
+    this.site = site;
+    this.contractMessage = contractMessage;
+  }
+}
+var OWN_FILE = import.meta.url.startsWith("file://") ? decodeURIComponent(import.meta.url.slice("file://".length)) : import.meta.url;
+var FRAME = /\(?([^()\s]+):(\d+):\d+\)?\s*$/;
+function callSite() {
+  const frames = [];
+  for (const line of (new Error().stack ?? "").split(`
+`)) {
+    const m = FRAME.exec(line);
+    if (m?.[1] && m[2])
+      frames.push({ file: m[1], line: m[2] });
+  }
+  const outside = frames.find((f) => f.file !== OWN_FILE) ?? frames[3];
+  return outside ? `${outside.file}:${outside.line}` : "unknown:0";
+}
+function violationList() {
+  const g = globalThis;
+  const existing = g[CONTRACT_VIOLATIONS_KEY];
+  if (Array.isArray(existing))
+    return existing;
+  const list = [];
+  g[CONTRACT_VIOLATIONS_KEY] = list;
+  return list;
+}
+function violate(primitive, condition, message) {
+  if (condition)
+    return;
+  if (MODE === "off" || MODE === "ensures" && primitive === "requires")
+    return;
+  const violation = new ContractViolation(primitive, callSite(), message);
+  violationList().push(violation);
+  throw violation;
+}
+function drainContractViolations() {
+  const list = violationList();
+  return list.splice(0, list.length);
+}
+function requires(condition, message) {
+  violate("requires", condition, message);
+}
+function ensures(condition, message) {
+  violate("ensures", condition, message);
+}
 function inRange(value, min, max) {
   return value >= min && value <= max;
 }
@@ -52,7 +113,11 @@ function defineVerification(config) {
 }
 export {
   $constraints,
+  CONTRACT_VIOLATIONS_KEY,
+  ContractViolation,
+  contractsMode,
   defineVerification,
+  drainContractViolations,
   ensures,
   forAllPeers,
   hasLength,
@@ -63,4 +128,4 @@ export {
   stateConstraint
 };
 
-//# debugId=EB2A6F997258A60464756E2164756E21
+//# debugId=BFA2A054CE121A2F64756E2164756E21

package/dist/tools/verify/src/config.js.map

@@ -2,10 +2,10 @@
   "version": 3,
   "sources": ["../tools/verify/src/primitives/index.ts", "../tools/verify/src/config.ts"],
   "sourcesContent": [
-    "// Verification primitives for formal verification\n// These are runtime no-ops but extracted during verification\n\n/**\n * Assert a precondition that must be true when the handler executes.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ assertion\n *\n * @example\n * messageBus.on(\"USER_LOGIN\", (payload) => {\n *   requires(state.user.loggedIn === false, \"User must not be logged in\")\n *   state.user.loggedIn = true\n * })\n */\nexport function requires(condition: boolean, message?: string): void {\n  // Runtime no-op - only used during verification\n  // Condition and message are checked during static analysis only\n  void condition;\n  void message;\n}\n\n/**\n * Assert a postcondition that must be true after the handler completes.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ assertion\n *\n * @example\n * messageBus.on(\"USER_LOGIN\", (payload) => {\n *   state.user.loggedIn = true\n *   ensures(state.user.loggedIn === true, \"User must be logged in\")\n * })\n */\nexport function ensures(condition: boolean, message?: string): void {\n  // Runtime no-op - only used during verification\n  // Condition and message are checked during static analysis only\n  void condition;\n  void message;\n}\n\n/**\n * Define a global invariant that must always hold.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ invariant\n *\n * @example\n * invariant(\"UserIdConsistent\", () =>\n *   state.user.loggedIn === false || state.user.id !== null\n * )\n */\nexport function invariant(_name: string, condition: () => boolean): void {\n  // Runtime no-op - only used during verification\n  // Name and condition are checked during static analysis only\n  void condition;\n}\n\n/**\n * Assert that a value is within a valid range.\n *\n * @example\n * requires(inRange(todoCount, 0, 100), \"Todo count must be 0-100\")\n */\nexport function inRange(value: number, min: number, max: number): boolean {\n  return value >= min && value <= max;\n}\n\n/**\n * Assert that a value is one of the allowed values.\n *\n * @example\n * requires(oneOf(state.user.role, [\"admin\", \"user\"]), \"Role must be admin or user\")\n */\nexport function oneOf<T>(value: T, allowed: T[]): boolean {\n  return allowed.includes(value);\n}\n\n/**\n * Assert that an array has a specific length constraint.\n *\n * @example\n * requires(hasLength(state.todos, { max: 10 }), \"Too many todos\")\n */\nexport function hasLength(array: unknown[], constraint: { min?: number; max?: number }): boolean {\n  if (constraint.min !== undefined && array.length < constraint.min) return false;\n  if (constraint.max !== undefined && array.length > constraint.max) return false;\n  return true;\n}\n\n/**\n * Declare state-level constraints for verification and optional runtime checking.\n * Maps message types to preconditions on state fields.\n *\n * The parser automatically wires these constraints to handlers during verification.\n * Optionally, constraints can be enforced at runtime by passing `{ runtime: true }`.\n *\n * @example\n * // Verification only (TLA+ generation)\n * const state = { loggedIn: false };\n *\n * $constraints(\"loggedIn\", {\n *   USER_LOGOUT: { requires: \"state.loggedIn === true\", message: \"Must be logged in\" },\n *   BOOKMARK_ADD: { requires: \"state.loggedIn === true\", message: \"Must be logged in\" },\n * });\n *\n * @example\n * // Runtime enforcement (function predicates)\n * $constraints(\"loggedIn\", {\n *   USER_LOGOUT: {\n *     requires: (state) => state.loggedIn === true,\n *     message: \"Must be logged in to logout\"\n *   },\n * }, { runtime: true });\n */\nexport function $constraints(\n  stateField: string,\n  constraints: Record<\n    string,\n    {\n      requires?: string | ((state: unknown) => boolean);\n      ensures?: string | ((state: unknown) => boolean);\n      message?: string;\n    }\n  >,\n  options?: { runtime?: boolean }\n): void {\n  // Register constraints for runtime checking if enabled\n  if (options?.runtime) {\n    // Import dynamically to avoid circular dependencies\n    // This is safe because it only happens at runtime, not during static analysis\n    // @ts-expect-error - Dynamic import path resolves correctly at runtime\n    import(\"../../../src/shared/lib/constraints.js\")\n      .then(({ registerConstraints }) => {\n        registerConstraints(stateField, constraints);\n      })\n      .catch(() => {\n        // Silently ignore - constraints module may not be available during static analysis\n      });\n  }\n\n  // For verification: Still a no-op at runtime\n  // Parser extracts these and wires them to TLA+ handlers\n}\n\n/**\n * Declare a global state constraint that prunes structurally impossible states.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLC CONSTRAINT clause, discarding states\n * that violate the predicate from the exploration queue entirely.\n *\n * Unlike `invariant()` (which checks but still explores), `stateConstraint()`\n * prevents the model checker from ever reaching the pruned states.\n *\n * @example\n * stateConstraint(\"LeaderRequiresConnection\", () =>\n *   !connectionState.value.isLeader || connectionState.value.status === \"connected\"\n * )\n */\nexport function stateConstraint(\n  name: string,\n  predicate: () => boolean,\n  options?: { message?: string }\n): void {\n  void name;\n  void predicate;\n  void options;\n}\n\n/**\n * Cross-peer universal quantifier for use inside `requires` and\n * `ensures` predicates. The runtime is a no-op that simply runs the\n * predicate against a single dummy context (so the assertion never\n * triggers at runtime); the verifier recognizes the wrapper in\n * predicate source and emits a `\\A peer \\in Contexts \\ {ctx} : (...)`\n * clause that asks TLC to check the inner predicate against every\n * other context.\n *\n * @example\n * ensures(\n *   forAllPeers(peer => peer.todos.value.length === todos.value.length),\n *   \"every peer agrees on todo count\"\n * );\n */\nexport function forAllPeers<TPeer>(predicate: (peer: TPeer) => boolean): boolean {\n  void predicate;\n  return true;\n}\n\n/**\n * Cross-peer existential quantifier for use inside `requires` and\n * `ensures` predicates. Runtime no-op; the verifier emits a\n * `\\E peer \\in Contexts \\ {ctx} : (...)` clause.\n *\n * @example\n * ensures(\n *   somePeer(peer => peer.user.value.loggedIn === true),\n *   \"at least one peer has a logged-in user\"\n * );\n */\nexport function somePeer<TPeer>(predicate: (peer: TPeer) => boolean): boolean {\n  void predicate;\n  return true;\n}\n\n// Re-export for convenience\nexport const verify = {\n  requires,\n  ensures,\n  invariant,\n  inRange,\n  oneOf,\n  hasLength,\n  $constraints,\n  stateConstraint,\n  forAllPeers,\n  somePeer,\n};\n",
-    "// Configuration Helper for @fairfox/polly/verify\n//\n// Lightweight entry point for user configuration files.\n// Does NOT include heavy dependencies (ts-morph, analysis, etc.)\n// which are only needed by the CLI tool.\n\n// Configuration Types (inlined to avoid heavy dependencies)\n\n// polly#160: a directional capability whose grant requires a precondition.\n// Desugars to a TLA+ safety invariant `(enabledBy) => (requires)`. enabledBy /\n// requires are TS boolean expressions in the requires()/ensures() dialect\n// referencing state via `state.` / signal `.value` form (e.g. \"state.authReady\").\n// Inlined here (like SubsystemConfig) so this authoring entry point stays\n// dependency-light; the canonical type is CapabilityConfig in config/types.ts.\ninterface CapabilityConfig {\n  name: string;\n  enabledBy: string;\n  requires: string;\n  message?: string;\n}\n\n// Subsystem configuration for compositional verification\ninterface SubsystemConfig {\n  state: string[]; // Field names from parent state config\n  handlers: string[]; // Message type names\n  // Per-subsystem message bounds; override messages.maxInFlight and merge\n  // into messages.perMessageBounds for this subsystem only.\n  bounds?: {\n    maxInFlight?: number;\n    perMessageBounds?: Record<string, number>;\n  };\n  /** polly#171: check message-resolution liveness for this subsystem only. */\n  liveness?: boolean;\n}\n\n// Point a subsystem's reachability witnesses at a hand-written TLA+ spec instead\n// of the generated UserApp_<subsystem>. Inlined here (like SubsystemConfig) to\n// keep this authoring entry point dependency-light; canonical type is\n// CustomTLAPath in config/types.ts.\ninterface CustomTLAPath {\n  tla: string; // path (relative to cwd) to the hand-written .tla the witness EXTENDS\n  cfg: string; // path (relative to cwd) to its .cfg\n  module?: string; // module to EXTEND; defaults to the MODULE name parsed from `tla`\n  fields?: Record<string, string>; // BDD field name → this spec's TLA+ variable name\n}\n\n// Legacy verification configuration\ninterface LegacyVerificationConfig {\n  state: Record<string, unknown>;\n  /**\n   * polly#185: the contexts this project actually has, emitted as the `.cfg`'s\n   * `Contexts` set.\n   *\n   * Every generated model replicates application state across the set and\n   * quantifies each send over `|Contexts| * (2^|Contexts| - 1)` source/target\n   * pairs, so its size is the cheapest term in the state space to cut.\n   * Measured on a two-handler model at `maxInFlight: 1`: 38,464 distinct\n   * states at three contexts, 368 at one.\n   *\n   * Names become TLA+ model values, so each must sanitise to\n   * `[A-Za-z_][A-Za-z0-9_]*`. Omit the key to keep the browser-extension\n   * default `[\"background\", \"content\", \"popup\"]`.\n   *\n   * A single context makes every send a self-send, and disables\n   * `PropagateMeshOp` (which requires two distinct contexts) — so a `mesh`\n   * block wants at least two.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   contexts: [\"server\", \"client\"],\n   *   state: { ready: { type: \"boolean\" } },\n   *   messages: { maxInFlight: 1 },\n   * });\n   * ```\n   */\n  contexts?: string[];\n\n  /**\n   * polly#117: optional mesh-document declarations. When present, each\n   * key names a `$meshState` document and its value declares the\n   * field-level state schema for that document. The verifier emits a\n   * separate slot in `contextStates[ctx].mesh[<docId>]` for these\n   * fields and adds a `PropagateMeshOp` action that allows the doc's\n   * value on one context to flow to another — modelling Automerge\n   * sync between peers. Mesh references inside `forAllPeers` quantifiers\n   * route through this slot so cross-peer convergence claims are\n   * actually checked.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   state: { localCounter: { type: \"number\", min: 0, max: 3 } },\n   *   mesh: {\n   *     todos: {\n   *       entries: { type: \"enum\", values: [\"empty\", \"one\", \"many\"] },\n   *     },\n   *   },\n   *   messages: { maxInFlight: 2 },\n   * });\n   * ```\n   */\n  mesh?: Record<string, Record<string, unknown>>;\n  messages: {\n    // Basic bounds\n    maxInFlight?: number;\n    maxTabs?: number;\n    maxClients?: number;\n    maxRenderers?: number;\n    maxWorkers?: number;\n    maxContexts?: number;\n\n    // Tier 1 Optimizations (no precision loss)\n    include?: string[]; // Only verify these message types\n    exclude?: string[]; // Exclude these message types (mutually exclusive with include)\n    symmetry?: string[][]; // Groups of symmetric message types [[type1, type2], [type3, type4]]\n    perMessageBounds?: Record<string, number>; // Different maxInFlight per message type\n  };\n  onBuild?: \"warn\" | \"error\" | \"off\";\n  onRelease?: \"warn\" | \"error\" | \"off\";\n\n  // Verification engine options\n  verification?: {\n    timeout?: number; // Timeout in seconds (0 = no timeout)\n    workers?: number; // Number of TLC workers\n    /**\n     * polly#181: docker-style container memory ceiling for the TLC run, e.g.\n     * \"8g\". The JVM heap is sized under it, so a model too large for the\n     * ceiling ends with a TLC out-of-memory message instead of a silent kill.\n     * Unset uses a fixed default (4g), never unbounded.\n     */\n    memory?: string;\n  };\n\n  /**\n   * polly#171: check that nothing sent stays pending for ever.\n   *\n   * Off by default because it is expensive: it adds a temporal property and the\n   * routing fairness it needs, and TLC must then explore behaviours rather than\n   * only reachable states. Measured on an 11-subsystem consumer model, the full\n   * verify gate went from ~110s to ~512s.\n   *\n   * Every property the generator emits without this is a SAFETY property, and a\n   * safety property is true of a system that does nothing at all — so a spec in\n   * which routing has stopped verifies identically to one in which it works.\n   * Turn this on for the subsystems whose progress actually matters.\n   *\n   * LIMITATION, and it is Lamport's own warning (Specifying Systems 14.3.5):\n   * generated specs also declare a CONSTRAINT to bound the state space, and TLC\n   * prints \"Declaring state or action constraints during liveness checking is\n   * dangerous\" when both are present. A constraint truncates behaviours at its\n   * boundary, so a liveness violation reachable only beyond that boundary is not\n   * found. Treat a green liveness run as \"no wedge within the bounds\", not as a\n   * proof of progress — the same reading every bounded model-checking result\n   * deserves.\n   */\n  liveness?: boolean;\n\n  // Subsystem-scoped verification (compositional)\n  subsystems?: Record<string, SubsystemConfig>;\n\n  // Bind a subsystem's witnesses to a hand-written .tla/.cfg (read only by the\n  // --witness pass; a custom subsystem is skipped during generated-spec verify).\n  customTLAPaths?: Record<string, CustomTLAPath>;\n\n  // Tier 2 Optimizations (controlled approximations)\n  tier2?: {\n    // Temporal constraints: ordering requirements between messages\n    temporalConstraints?: Array<{\n      before: string; // Message type that must occur first\n      after: string; // Message type that must occur after\n      description?: string; // Human-readable description\n    }>;\n\n    // Bounded exploration: limit depth for specific scenarios\n    boundedExploration?: {\n      maxDepth?: number; // Maximum state depth to explore\n      criticalPaths?: string[][]; // Sequences of message types that must be fully explored\n    };\n  };\n\n  // polly#160: directional capability invariants + write-coupling lint groups\n  capabilities?: CapabilityConfig[];\n  coupledFields?: string[][];\n}\n\n// Adapter-based configuration (for future use)\ninterface AdapterVerificationConfig {\n  adapter: unknown; // Adapter interface not exported to avoid heavy deps\n  state: Record<string, unknown>;\n  /**\n   * polly#185: the contexts this project actually has, emitted as the `.cfg`'s\n   * `Contexts` set.\n   *\n   * Every generated model replicates application state across the set and\n   * quantifies each send over `|Contexts| * (2^|Contexts| - 1)` source/target\n   * pairs, so its size is the cheapest term in the state space to cut.\n   * Measured on a two-handler model at `maxInFlight: 1`: 38,464 distinct\n   * states at three contexts, 368 at one.\n   *\n   * Names become TLA+ model values, so each must sanitise to\n   * `[A-Za-z_][A-Za-z0-9_]*`. Omit the key to keep the browser-extension\n   * default `[\"background\", \"content\", \"popup\"]`.\n   *\n   * A single context makes every send a self-send, and disables\n   * `PropagateMeshOp` (which requires two distinct contexts) — so a `mesh`\n   * block wants at least two.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   contexts: [\"server\", \"client\"],\n   *   state: { ready: { type: \"boolean\" } },\n   *   messages: { maxInFlight: 1 },\n   * });\n   * ```\n   */\n  contexts?: string[];\n\n  bounds?: {\n    maxInFlight?: number;\n    [key: string]: unknown;\n  };\n  onBuild?: \"warn\" | \"error\" | \"off\";\n\n  // polly#160: directional capability invariants + write-coupling lint groups\n  capabilities?: CapabilityConfig[];\n  coupledFields?: string[][];\n}\n\n// Union type for both config formats\ntype UnifiedVerificationConfig = LegacyVerificationConfig | AdapterVerificationConfig;\n\n/**\n * Define verification configuration with type checking\n *\n * Used in generated verification.config.ts files.\n *\n * @example\n * ```typescript\n * import { defineVerification } from '@fairfox/polly/verify'\n *\n * export default defineVerification({\n *   state: {\n *     \"user.role\": { type: \"enum\", values: [\"admin\", \"user\", \"guest\"] },\n *   },\n *   messages: {\n *     maxInFlight: 6,\n *     maxTabs: 2,\n *   },\n * })\n * ```\n */\nexport function defineVerification<T extends UnifiedVerificationConfig>(config: T): T {\n  // Validate configuration structure\n  if (\"adapter\" in config) {\n    // New adapter-based format\n    if (!config.adapter) {\n      throw new Error(\"Configuration must include an adapter\");\n    }\n    if (!config.state) {\n      throw new Error(\"Configuration must include state bounds\");\n    }\n  } else if (\"messages\" in config) {\n    // Legacy format\n    if (!config.state) {\n      throw new Error(\"Configuration must include state bounds\");\n    }\n    if (!config.messages) {\n      throw new Error(\"Legacy configuration must include messages bounds\");\n    }\n  } else {\n    throw new Error(\n      \"Invalid configuration format. Must include either 'adapter' (new format) or 'messages' (legacy format)\"\n    );\n  }\n\n  return config;\n}\n\n// Re-export verification primitives for user code\nexport {\n  $constraints,\n  ensures,\n  forAllPeers,\n  hasLength,\n  inRange,\n  oneOf,\n  requires,\n  somePeer,\n  stateConstraint,\n} from \"./primitives/index.js\";\n"
+    "// Verification primitives for formal verification.\n//\n// `requires` / `ensures` are runtime no-ops in production: the caller\n// evaluates the condition, the primitive discards it, and only the verifier\n// reads the call. Under POLLY_CONTRACTS (set by `polly mutate`, or by hand)\n// a false condition throws a ContractViolation instead, so every contract\n// doubles as an assertion in whatever test drives its handler.\n\n/**\n * POLLY_CONTRACTS: off (default) keeps requires/ensures as no-ops; \"ensures\"\n * makes a false postcondition throw; \"all\" makes a false precondition throw too.\n */\nexport type ContractsMode = \"off\" | \"ensures\" | \"all\";\n\nexport type ContractPrimitive = \"requires\" | \"ensures\";\n\n/**\n * Where violations are recorded before they are thrown, so a harness can fail\n * a test even when the caller (the message bus) swallowed the throw. The\n * mutate preload and the BDD runner read this key; they repeat the string\n * because they import no module of this package.\n */\nexport const CONTRACT_VIOLATIONS_KEY = \"__pollyContractViolations\";\n\n/** Read once at load; browser bundles have no `process`, so they stay off. */\nfunction readContractsMode(): ContractsMode {\n  const v =\n    typeof process !== \"undefined\" && process.env ? process.env[\"POLLY_CONTRACTS\"] : undefined;\n  return v === \"all\" || v === \"ensures\" ? v : \"off\";\n}\n\nconst MODE: ContractsMode = readContractsMode();\n\n/** The mode this process runs under (read from POLLY_CONTRACTS at load). */\nexport function contractsMode(): ContractsMode {\n  return MODE;\n}\n\n/**\n * A false `requires` / `ensures` under POLLY_CONTRACTS. The message starts\n * with a marker the mutate engine reads out of junit failure text:\n * `[polly-contract ensures /abs/handlers.ts:50] the author's message`.\n */\nexport class ContractViolation extends Error {\n  override readonly name = \"ContractViolation\";\n  constructor(\n    readonly primitive: ContractPrimitive,\n    /** `file:line` of the call, absolute. */\n    readonly site: string,\n    readonly contractMessage?: string\n  ) {\n    super(\n      `[polly-contract ${primitive} ${site}]${contractMessage === undefined ? \"\" : ` ${contractMessage}`}`\n    );\n  }\n}\n\nconst OWN_FILE = import.meta.url.startsWith(\"file://\")\n  ? decodeURIComponent(import.meta.url.slice(\"file://\".length))\n  : import.meta.url;\nconst FRAME = /\\(?([^()\\s]+):(\\d+):\\d+\\)?\\s*$/;\n\n/**\n * `file:line` of the `requires` / `ensures` call: the first stack frame\n * outside this module. When this module is bundled with its caller every\n * frame is \"own\", so the fourth frame (callSite, violate, the primitive,\n * caller) is taken instead.\n */\nfunction callSite(): string {\n  const frames: { file: string; line: string }[] = [];\n  for (const line of (new Error().stack ?? \"\").split(\"\\n\")) {\n    const m = FRAME.exec(line);\n    if (m?.[1] && m[2]) frames.push({ file: m[1], line: m[2] });\n  }\n  const outside = frames.find((f) => f.file !== OWN_FILE) ?? frames[3];\n  return outside ? `${outside.file}:${outside.line}` : \"unknown:0\";\n}\n\nfunction violationList(): ContractViolation[] {\n  const g = globalThis as Record<string, unknown>;\n  const existing = g[CONTRACT_VIOLATIONS_KEY];\n  if (Array.isArray(existing)) return existing as ContractViolation[];\n  const list: ContractViolation[] = [];\n  g[CONTRACT_VIOLATIONS_KEY] = list;\n  return list;\n}\n\nfunction violate(primitive: ContractPrimitive, condition: boolean, message?: string): void {\n  if (condition) return;\n  if (MODE === \"off\" || (MODE === \"ensures\" && primitive === \"requires\")) return;\n  const violation = new ContractViolation(primitive, callSite(), message);\n  violationList().push(violation);\n  throw violation;\n}\n\n/** Return every violation recorded since the last drain, and clear the list. */\nexport function drainContractViolations(): ContractViolation[] {\n  const list = violationList();\n  return list.splice(0, list.length);\n}\n\n/**\n * Assert a precondition that must be true when the handler executes.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ assertion\n * Under POLLY_CONTRACTS=all: throws ContractViolation when false\n *\n * @example\n * messageBus.on(\"USER_LOGIN\", (payload) => {\n *   requires(state.user.loggedIn === false, \"User must not be logged in\")\n *   state.user.loggedIn = true\n * })\n */\nexport function requires(condition: boolean, message?: string): void {\n  // No-op unless POLLY_CONTRACTS is \"all\"; the verifier reads the call statically.\n  violate(\"requires\", condition, message);\n}\n\n/**\n * Assert a postcondition that must be true after the handler completes.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ assertion\n * Under POLLY_CONTRACTS=ensures|all: throws ContractViolation when false\n *\n * @example\n * messageBus.on(\"USER_LOGIN\", (payload) => {\n *   state.user.loggedIn = true\n *   ensures(state.user.loggedIn === true, \"User must be logged in\")\n * })\n */\nexport function ensures(condition: boolean, message?: string): void {\n  // No-op unless POLLY_CONTRACTS is set; the verifier reads the call statically.\n  violate(\"ensures\", condition, message);\n}\n\n/**\n * Define a global invariant that must always hold.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLA+ invariant\n *\n * @example\n * invariant(\"UserIdConsistent\", () =>\n *   state.user.loggedIn === false || state.user.id !== null\n * )\n */\nexport function invariant(_name: string, condition: () => boolean): void {\n  // Runtime no-op - only used during verification\n  // Name and condition are checked during static analysis only\n  void condition;\n}\n\n/**\n * Assert that a value is within a valid range.\n *\n * @example\n * requires(inRange(todoCount, 0, 100), \"Todo count must be 0-100\")\n */\nexport function inRange(value: number, min: number, max: number): boolean {\n  return value >= min && value <= max;\n}\n\n/**\n * Assert that a value is one of the allowed values.\n *\n * @example\n * requires(oneOf(state.user.role, [\"admin\", \"user\"]), \"Role must be admin or user\")\n */\nexport function oneOf<T>(value: T, allowed: T[]): boolean {\n  return allowed.includes(value);\n}\n\n/**\n * Assert that an array has a specific length constraint.\n *\n * @example\n * requires(hasLength(state.todos, { max: 10 }), \"Too many todos\")\n */\nexport function hasLength(array: unknown[], constraint: { min?: number; max?: number }): boolean {\n  if (constraint.min !== undefined && array.length < constraint.min) return false;\n  if (constraint.max !== undefined && array.length > constraint.max) return false;\n  return true;\n}\n\n/**\n * Declare state-level constraints for verification and optional runtime checking.\n * Maps message types to preconditions on state fields.\n *\n * The parser automatically wires these constraints to handlers during verification.\n * Optionally, constraints can be enforced at runtime by passing `{ runtime: true }`.\n *\n * @example\n * // Verification only (TLA+ generation)\n * const state = { loggedIn: false };\n *\n * $constraints(\"loggedIn\", {\n *   USER_LOGOUT: { requires: \"state.loggedIn === true\", message: \"Must be logged in\" },\n *   BOOKMARK_ADD: { requires: \"state.loggedIn === true\", message: \"Must be logged in\" },\n * });\n *\n * @example\n * // Runtime enforcement (function predicates)\n * $constraints(\"loggedIn\", {\n *   USER_LOGOUT: {\n *     requires: (state) => state.loggedIn === true,\n *     message: \"Must be logged in to logout\"\n *   },\n * }, { runtime: true });\n */\nexport function $constraints(\n  stateField: string,\n  constraints: Record<\n    string,\n    {\n      requires?: string | ((state: unknown) => boolean);\n      ensures?: string | ((state: unknown) => boolean);\n      message?: string;\n    }\n  >,\n  options?: { runtime?: boolean }\n): void {\n  // Register constraints for runtime checking if enabled\n  if (options?.runtime) {\n    // Import dynamically to avoid circular dependencies\n    // This is safe because it only happens at runtime, not during static analysis\n    // @ts-expect-error - Dynamic import path resolves correctly at runtime\n    import(\"../../../src/shared/lib/constraints.js\")\n      .then(({ registerConstraints }) => {\n        registerConstraints(stateField, constraints);\n      })\n      .catch(() => {\n        // Silently ignore - constraints module may not be available during static analysis\n      });\n  }\n\n  // For verification: Still a no-op at runtime\n  // Parser extracts these and wires them to TLA+ handlers\n}\n\n/**\n * Declare a global state constraint that prunes structurally impossible states.\n *\n * In production: No-op (compiled away)\n * In verification: Translated to TLC CONSTRAINT clause, discarding states\n * that violate the predicate from the exploration queue entirely.\n *\n * Unlike `invariant()` (which checks but still explores), `stateConstraint()`\n * prevents the model checker from ever reaching the pruned states.\n *\n * @example\n * stateConstraint(\"LeaderRequiresConnection\", () =>\n *   !connectionState.value.isLeader || connectionState.value.status === \"connected\"\n * )\n */\nexport function stateConstraint(\n  name: string,\n  predicate: () => boolean,\n  options?: { message?: string }\n): void {\n  void name;\n  void predicate;\n  void options;\n}\n\n/**\n * Cross-peer universal quantifier for use inside `requires` and\n * `ensures` predicates. The runtime is a no-op that simply runs the\n * predicate against a single dummy context (so the assertion never\n * triggers at runtime); the verifier recognizes the wrapper in\n * predicate source and emits a `\\A peer \\in Contexts \\ {ctx} : (...)`\n * clause that asks TLC to check the inner predicate against every\n * other context.\n *\n * @example\n * ensures(\n *   forAllPeers(peer => peer.todos.value.length === todos.value.length),\n *   \"every peer agrees on todo count\"\n * );\n */\nexport function forAllPeers<TPeer>(predicate: (peer: TPeer) => boolean): boolean {\n  void predicate;\n  return true;\n}\n\n/**\n * Cross-peer existential quantifier for use inside `requires` and\n * `ensures` predicates. Runtime no-op; the verifier emits a\n * `\\E peer \\in Contexts \\ {ctx} : (...)` clause.\n *\n * @example\n * ensures(\n *   somePeer(peer => peer.user.value.loggedIn === true),\n *   \"at least one peer has a logged-in user\"\n * );\n */\nexport function somePeer<TPeer>(predicate: (peer: TPeer) => boolean): boolean {\n  void predicate;\n  return true;\n}\n\n// Re-export for convenience\nexport const verify = {\n  requires,\n  ensures,\n  invariant,\n  inRange,\n  oneOf,\n  hasLength,\n  $constraints,\n  stateConstraint,\n  forAllPeers,\n  somePeer,\n};\n",
+    "// Configuration Helper for @fairfox/polly/verify\n//\n// Lightweight entry point for user configuration files.\n// Does NOT include heavy dependencies (ts-morph, analysis, etc.)\n// which are only needed by the CLI tool.\n\n// Configuration Types (inlined to avoid heavy dependencies)\n\n// polly#160: a directional capability whose grant requires a precondition.\n// Desugars to a TLA+ safety invariant `(enabledBy) => (requires)`. enabledBy /\n// requires are TS boolean expressions in the requires()/ensures() dialect\n// referencing state via `state.` / signal `.value` form (e.g. \"state.authReady\").\n// Inlined here (like SubsystemConfig) so this authoring entry point stays\n// dependency-light; the canonical type is CapabilityConfig in config/types.ts.\ninterface CapabilityConfig {\n  name: string;\n  enabledBy: string;\n  requires: string;\n  message?: string;\n}\n\n// Subsystem configuration for compositional verification\ninterface SubsystemConfig {\n  state: string[]; // Field names from parent state config\n  handlers: string[]; // Message type names\n  // Per-subsystem message bounds; override messages.maxInFlight and merge\n  // into messages.perMessageBounds for this subsystem only.\n  bounds?: {\n    maxInFlight?: number;\n    perMessageBounds?: Record<string, number>;\n  };\n  /** polly#171: check message-resolution liveness for this subsystem only. */\n  liveness?: boolean;\n}\n\n// Point a subsystem's reachability witnesses at a hand-written TLA+ spec instead\n// of the generated UserApp_<subsystem>. Inlined here (like SubsystemConfig) to\n// keep this authoring entry point dependency-light; canonical type is\n// CustomTLAPath in config/types.ts.\ninterface CustomTLAPath {\n  tla: string; // path (relative to cwd) to the hand-written .tla the witness EXTENDS\n  cfg: string; // path (relative to cwd) to its .cfg\n  module?: string; // module to EXTEND; defaults to the MODULE name parsed from `tla`\n  fields?: Record<string, string>; // BDD field name → this spec's TLA+ variable name\n}\n\n// Legacy verification configuration\ninterface LegacyVerificationConfig {\n  state: Record<string, unknown>;\n  /**\n   * polly#185: the contexts this project actually has, emitted as the `.cfg`'s\n   * `Contexts` set.\n   *\n   * Every generated model replicates application state across the set and\n   * quantifies each send over `|Contexts| * (2^|Contexts| - 1)` source/target\n   * pairs, so its size is the cheapest term in the state space to cut.\n   * Measured on a two-handler model at `maxInFlight: 1`: 38,464 distinct\n   * states at three contexts, 368 at one.\n   *\n   * Names become TLA+ model values, so each must sanitise to\n   * `[A-Za-z_][A-Za-z0-9_]*`. Omit the key to keep the browser-extension\n   * default `[\"background\", \"content\", \"popup\"]`.\n   *\n   * A single context makes every send a self-send, and disables\n   * `PropagateMeshOp` (which requires two distinct contexts) — so a `mesh`\n   * block wants at least two.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   contexts: [\"server\", \"client\"],\n   *   state: { ready: { type: \"boolean\" } },\n   *   messages: { maxInFlight: 1 },\n   * });\n   * ```\n   */\n  contexts?: string[];\n\n  /**\n   * polly#117: optional mesh-document declarations. When present, each\n   * key names a `$meshState` document and its value declares the\n   * field-level state schema for that document. The verifier emits a\n   * separate slot in `contextStates[ctx].mesh[<docId>]` for these\n   * fields and adds a `PropagateMeshOp` action that allows the doc's\n   * value on one context to flow to another — modelling Automerge\n   * sync between peers. Mesh references inside `forAllPeers` quantifiers\n   * route through this slot so cross-peer convergence claims are\n   * actually checked.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   state: { localCounter: { type: \"number\", min: 0, max: 3 } },\n   *   mesh: {\n   *     todos: {\n   *       entries: { type: \"enum\", values: [\"empty\", \"one\", \"many\"] },\n   *     },\n   *   },\n   *   messages: { maxInFlight: 2 },\n   * });\n   * ```\n   */\n  mesh?: Record<string, Record<string, unknown>>;\n  messages: {\n    // Basic bounds\n    maxInFlight?: number;\n    maxTabs?: number;\n    maxClients?: number;\n    maxRenderers?: number;\n    maxWorkers?: number;\n    maxContexts?: number;\n\n    // Tier 1 Optimizations (no precision loss)\n    include?: string[]; // Only verify these message types\n    exclude?: string[]; // Exclude these message types (mutually exclusive with include)\n    symmetry?: string[][]; // Groups of symmetric message types [[type1, type2], [type3, type4]]\n    perMessageBounds?: Record<string, number>; // Different maxInFlight per message type\n  };\n  onBuild?: \"warn\" | \"error\" | \"off\";\n  onRelease?: \"warn\" | \"error\" | \"off\";\n\n  // Verification engine options\n  verification?: {\n    timeout?: number; // Timeout in seconds (0 = no timeout)\n    workers?: number; // Number of TLC workers\n    /**\n     * polly#181: docker-style container memory ceiling for the TLC run, e.g.\n     * \"8g\". The JVM heap is sized under it, so a model too large for the\n     * ceiling ends with a TLC out-of-memory message instead of a silent kill.\n     * Unset uses a fixed default (4g), never unbounded.\n     */\n    memory?: string;\n  };\n\n  /**\n   * polly#171: check that nothing sent stays pending for ever.\n   *\n   * Off by default because it is expensive: it adds a temporal property and the\n   * routing fairness it needs, and TLC must then explore behaviours rather than\n   * only reachable states. Measured on an 11-subsystem consumer model, the full\n   * verify gate went from ~110s to ~512s.\n   *\n   * Every property the generator emits without this is a SAFETY property, and a\n   * safety property is true of a system that does nothing at all — so a spec in\n   * which routing has stopped verifies identically to one in which it works.\n   * Turn this on for the subsystems whose progress actually matters.\n   *\n   * LIMITATION, and it is Lamport's own warning (Specifying Systems 14.3.5):\n   * generated specs also declare a CONSTRAINT to bound the state space, and TLC\n   * prints \"Declaring state or action constraints during liveness checking is\n   * dangerous\" when both are present. A constraint truncates behaviours at its\n   * boundary, so a liveness violation reachable only beyond that boundary is not\n   * found. Treat a green liveness run as \"no wedge within the bounds\", not as a\n   * proof of progress — the same reading every bounded model-checking result\n   * deserves.\n   */\n  liveness?: boolean;\n\n  // Subsystem-scoped verification (compositional)\n  subsystems?: Record<string, SubsystemConfig>;\n\n  // Bind a subsystem's witnesses to a hand-written .tla/.cfg (read only by the\n  // --witness pass; a custom subsystem is skipped during generated-spec verify).\n  customTLAPaths?: Record<string, CustomTLAPath>;\n\n  // Tier 2 Optimizations (controlled approximations)\n  tier2?: {\n    // Temporal constraints: ordering requirements between messages\n    temporalConstraints?: Array<{\n      before: string; // Message type that must occur first\n      after: string; // Message type that must occur after\n      description?: string; // Human-readable description\n    }>;\n\n    // Bounded exploration: limit depth for specific scenarios\n    boundedExploration?: {\n      maxDepth?: number; // Maximum state depth to explore\n      criticalPaths?: string[][]; // Sequences of message types that must be fully explored\n    };\n  };\n\n  // polly#160: directional capability invariants + write-coupling lint groups\n  capabilities?: CapabilityConfig[];\n  coupledFields?: string[][];\n}\n\n// Adapter-based configuration (for future use)\ninterface AdapterVerificationConfig {\n  adapter: unknown; // Adapter interface not exported to avoid heavy deps\n  state: Record<string, unknown>;\n  /**\n   * polly#185: the contexts this project actually has, emitted as the `.cfg`'s\n   * `Contexts` set.\n   *\n   * Every generated model replicates application state across the set and\n   * quantifies each send over `|Contexts| * (2^|Contexts| - 1)` source/target\n   * pairs, so its size is the cheapest term in the state space to cut.\n   * Measured on a two-handler model at `maxInFlight: 1`: 38,464 distinct\n   * states at three contexts, 368 at one.\n   *\n   * Names become TLA+ model values, so each must sanitise to\n   * `[A-Za-z_][A-Za-z0-9_]*`. Omit the key to keep the browser-extension\n   * default `[\"background\", \"content\", \"popup\"]`.\n   *\n   * A single context makes every send a self-send, and disables\n   * `PropagateMeshOp` (which requires two distinct contexts) — so a `mesh`\n   * block wants at least two.\n   *\n   * @example\n   * ```ts\n   * defineVerification({\n   *   contexts: [\"server\", \"client\"],\n   *   state: { ready: { type: \"boolean\" } },\n   *   messages: { maxInFlight: 1 },\n   * });\n   * ```\n   */\n  contexts?: string[];\n\n  bounds?: {\n    maxInFlight?: number;\n    [key: string]: unknown;\n  };\n  onBuild?: \"warn\" | \"error\" | \"off\";\n\n  // polly#160: directional capability invariants + write-coupling lint groups\n  capabilities?: CapabilityConfig[];\n  coupledFields?: string[][];\n}\n\n// Union type for both config formats\ntype UnifiedVerificationConfig = LegacyVerificationConfig | AdapterVerificationConfig;\n\n/**\n * Define verification configuration with type checking\n *\n * Used in generated verification.config.ts files.\n *\n * @example\n * ```typescript\n * import { defineVerification } from '@fairfox/polly/verify'\n *\n * export default defineVerification({\n *   state: {\n *     \"user.role\": { type: \"enum\", values: [\"admin\", \"user\", \"guest\"] },\n *   },\n *   messages: {\n *     maxInFlight: 6,\n *     maxTabs: 2,\n *   },\n * })\n * ```\n */\nexport function defineVerification<T extends UnifiedVerificationConfig>(config: T): T {\n  // Validate configuration structure\n  if (\"adapter\" in config) {\n    // New adapter-based format\n    if (!config.adapter) {\n      throw new Error(\"Configuration must include an adapter\");\n    }\n    if (!config.state) {\n      throw new Error(\"Configuration must include state bounds\");\n    }\n  } else if (\"messages\" in config) {\n    // Legacy format\n    if (!config.state) {\n      throw new Error(\"Configuration must include state bounds\");\n    }\n    if (!config.messages) {\n      throw new Error(\"Legacy configuration must include messages bounds\");\n    }\n  } else {\n    throw new Error(\n      \"Invalid configuration format. Must include either 'adapter' (new format) or 'messages' (legacy format)\"\n    );\n  }\n\n  return config;\n}\n\n// Re-export verification primitives for user code\nexport {\n  $constraints,\n  CONTRACT_VIOLATIONS_KEY,\n  type ContractPrimitive,\n  type ContractsMode,\n  ContractViolation,\n  contractsMode,\n  drainContractViolations,\n  ensures,\n  forAllPeers,\n  hasLength,\n  inRange,\n  oneOf,\n  requires,\n  somePeer,\n  stateConstraint,\n} from \"./primitives/index.js\";\n"
   ],
-  "mappings": ";AAeO,SAAS,QAAQ,CAAC,WAAoB,SAAwB;AAmB9D,SAAS,OAAO,CAAC,WAAoB,SAAwB;AA8B7D,SAAS,OAAO,CAAC,OAAe,KAAa,KAAsB;AAAA,EACxE,OAAO,SAAS,OAAO,SAAS;AAAA;AAS3B,SAAS,KAAQ,CAAC,OAAU,SAAuB;AAAA,EACxD,OAAO,QAAQ,SAAS,KAAK;AAAA;AASxB,SAAS,SAAS,CAAC,OAAkB,YAAqD;AAAA,EAC/F,IAAI,WAAW,QAAQ,aAAa,MAAM,SAAS,WAAW;AAAA,IAAK,OAAO;AAAA,EAC1E,IAAI,WAAW,QAAQ,aAAa,MAAM,SAAS,WAAW;AAAA,IAAK,OAAO;AAAA,EAC1E,OAAO;AAAA;AA4BF,SAAS,YAAY,CAC1B,YACA,aAQA,SACM;AAAA,EAEN,IAAI,SAAS,SAAS;AAAA,IAIb,iDACJ,KAAK,GAAG,0BAA0B;AAAA,MACjC,oBAAoB,YAAY,WAAW;AAAA,KAC5C,EACA,MAAM,MAAM,EAEZ;AAAA,EACL;AAAA;AAqBK,SAAS,eAAe,CAC7B,MACA,WACA,SACM;AAqBD,SAAS,WAAkB,CAAC,WAA8C;AAAA,EAE/E,OAAO;AAAA;AAcF,SAAS,QAAe,CAAC,WAA8C;AAAA,EAE5E,OAAO;AAAA;;;ACkDF,SAAS,kBAAuD,CAAC,QAAc;AAAA,EAEpF,IAAI,aAAa,QAAQ;AAAA,IAEvB,IAAI,CAAC,OAAO,SAAS;AAAA,MACnB,MAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAAA,IACA,IAAI,CAAC,OAAO,OAAO;AAAA,MACjB,MAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAAA,EACF,EAAO,SAAI,cAAc,QAAQ;AAAA,IAE/B,IAAI,CAAC,OAAO,OAAO;AAAA,MACjB,MAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAAA,IACA,IAAI,CAAC,OAAO,UAAU;AAAA,MACpB,MAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF,EAAO;AAAA,IACL,MAAM,IAAI,MACR,wGACF;AAAA;AAAA,EAGF,OAAO;AAAA;",
-  "debugId": "EB2A6F997258A60464756E2164756E21",
+  "mappings": ";AAsBO,IAAM,0BAA0B;AAGvC,SAAS,iBAAiB,GAAkB;AAAA,EAC1C,MAAM,IACJ,OAAO,YAAY,eAAe,QAAQ,MAAM,QAAQ,IAAI,qBAAqB;AAAA,EACnF,OAAO,MAAM,SAAS,MAAM,YAAY,IAAI;AAAA;AAG9C,IAAM,OAAsB,kBAAkB;AAGvC,SAAS,aAAa,GAAkB;AAAA,EAC7C,OAAO;AAAA;AAAA;AAQF,MAAM,0BAA0B,MAAM;AAAA,EAGhC;AAAA,EAEA;AAAA,EACA;AAAA,EALO,OAAO;AAAA,EACzB,WAAW,CACA,WAEA,MACA,iBACT;AAAA,IACA,MACE,mBAAmB,aAAa,QAAQ,oBAAoB,YAAY,KAAK,IAAI,mBACnF;AAAA,IAPS;AAAA,IAEA;AAAA,IACA;AAAA;AAMb;AAEA,IAAM,WAAW,YAAY,IAAI,WAAW,SAAS,IACjD,mBAAmB,YAAY,IAAI,MAAM,UAAU,MAAM,CAAC,IAC1D,YAAY;AAChB,IAAM,QAAQ;AAQd,SAAS,QAAQ,GAAW;AAAA,EAC1B,MAAM,SAA2C,CAAC;AAAA,EAClD,WAAW,SAAS,IAAI,MAAM,EAAE,SAAS,IAAI,MAAM;AAAA,CAAI,GAAG;AAAA,IACxD,MAAM,IAAI,MAAM,KAAK,IAAI;AAAA,IACzB,IAAI,IAAI,MAAM,EAAE;AAAA,MAAI,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,EAAE,GAAG,CAAC;AAAA,EAC5D;AAAA,EACA,MAAM,UAAU,OAAO,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ,KAAK,OAAO;AAAA,EAClE,OAAO,UAAU,GAAG,QAAQ,QAAQ,QAAQ,SAAS;AAAA;AAGvD,SAAS,aAAa,GAAwB;AAAA,EAC5C,MAAM,IAAI;AAAA,EACV,MAAM,WAAW,EAAE;AAAA,EACnB,IAAI,MAAM,QAAQ,QAAQ;AAAA,IAAG,OAAO;AAAA,EACpC,MAAM,OAA4B,CAAC;AAAA,EACnC,EAAE,2BAA2B;AAAA,EAC7B,OAAO;AAAA;AAGT,SAAS,OAAO,CAAC,WAA8B,WAAoB,SAAwB;AAAA,EACzF,IAAI;AAAA,IAAW;AAAA,EACf,IAAI,SAAS,SAAU,SAAS,aAAa,cAAc;AAAA,IAAa;AAAA,EACxE,MAAM,YAAY,IAAI,kBAAkB,WAAW,SAAS,GAAG,OAAO;AAAA,EACtE,cAAc,EAAE,KAAK,SAAS;AAAA,EAC9B,MAAM;AAAA;AAID,SAAS,uBAAuB,GAAwB;AAAA,EAC7D,MAAM,OAAO,cAAc;AAAA,EAC3B,OAAO,KAAK,OAAO,GAAG,KAAK,MAAM;AAAA;AAgB5B,SAAS,QAAQ,CAAC,WAAoB,SAAwB;AAAA,EAEnE,QAAQ,YAAY,WAAW,OAAO;AAAA;AAgBjC,SAAS,OAAO,CAAC,WAAoB,SAAwB;AAAA,EAElE,QAAQ,WAAW,WAAW,OAAO;AAAA;AA0BhC,SAAS,OAAO,CAAC,OAAe,KAAa,KAAsB;AAAA,EACxE,OAAO,SAAS,OAAO,SAAS;AAAA;AAS3B,SAAS,KAAQ,CAAC,OAAU,SAAuB;AAAA,EACxD,OAAO,QAAQ,SAAS,KAAK;AAAA;AASxB,SAAS,SAAS,CAAC,OAAkB,YAAqD;AAAA,EAC/F,IAAI,WAAW,QAAQ,aAAa,MAAM,SAAS,WAAW;AAAA,IAAK,OAAO;AAAA,EAC1E,IAAI,WAAW,QAAQ,aAAa,MAAM,SAAS,WAAW;AAAA,IAAK,OAAO;AAAA,EAC1E,OAAO;AAAA;AA4BF,SAAS,YAAY,CAC1B,YACA,aAQA,SACM;AAAA,EAEN,IAAI,SAAS,SAAS;AAAA,IAIb,iDACJ,KAAK,GAAG,0BAA0B;AAAA,MACjC,oBAAoB,YAAY,WAAW;AAAA,KAC5C,EACA,MAAM,MAAM,EAEZ;AAAA,EACL;AAAA;AAqBK,SAAS,eAAe,CAC7B,MACA,WACA,SACM;AAqBD,SAAS,WAAkB,CAAC,WAA8C;AAAA,EAE/E,OAAO;AAAA;AAcF,SAAS,QAAe,CAAC,WAA8C;AAAA,EAE5E,OAAO;AAAA;;;AC9CF,SAAS,kBAAuD,CAAC,QAAc;AAAA,EAEpF,IAAI,aAAa,QAAQ;AAAA,IAEvB,IAAI,CAAC,OAAO,SAAS;AAAA,MACnB,MAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAAA,IACA,IAAI,CAAC,OAAO,OAAO;AAAA,MACjB,MAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAAA,EACF,EAAO,SAAI,cAAc,QAAQ;AAAA,IAE/B,IAAI,CAAC,OAAO,OAAO;AAAA,MACjB,MAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAAA,IACA,IAAI,CAAC,OAAO,UAAU;AAAA,MACpB,MAAM,IAAI,MAAM,mDAAmD;AAAA,IACrE;AAAA,EACF,EAAO;AAAA,IACL,MAAM,IAAI,MACR,wGACF;AAAA;AAAA,EAGF,OAAO;AAAA;",
+  "debugId": "BFA2A054CE121A2F64756E2164756E21",
   "names": []
 }

package/dist/tools/verify/src/primitives/index.d.ts

@@ -1,8 +1,41 @@
+/**
+ * POLLY_CONTRACTS: off (default) keeps requires/ensures as no-ops; "ensures"
+ * makes a false postcondition throw; "all" makes a false precondition throw too.
+ */
+export type ContractsMode = "off" | "ensures" | "all";
+export type ContractPrimitive = "requires" | "ensures";
+/**
+ * Where violations are recorded before they are thrown, so a harness can fail
+ * a test even when the caller (the message bus) swallowed the throw. The
+ * mutate preload and the BDD runner read this key; they repeat the string
+ * because they import no module of this package.
+ */
+export declare const CONTRACT_VIOLATIONS_KEY = "__pollyContractViolations";
+/** The mode this process runs under (read from POLLY_CONTRACTS at load). */
+export declare function contractsMode(): ContractsMode;
+/**
+ * A false `requires` / `ensures` under POLLY_CONTRACTS. The message starts
+ * with a marker the mutate engine reads out of junit failure text:
+ * `[polly-contract ensures /abs/handlers.ts:50] the author's message`.
+ */
+export declare class ContractViolation extends Error {
+    readonly primitive: ContractPrimitive;
+    /** `file:line` of the call, absolute. */
+    readonly site: string;
+    readonly contractMessage?: string | undefined;
+    readonly name = "ContractViolation";
+    constructor(primitive: ContractPrimitive, 
+    /** `file:line` of the call, absolute. */
+    site: string, contractMessage?: string | undefined);
+}
+/** Return every violation recorded since the last drain, and clear the list. */
+export declare function drainContractViolations(): ContractViolation[];
 /**
  * Assert a precondition that must be true when the handler executes.
  *
  * In production: No-op (compiled away)
  * In verification: Translated to TLA+ assertion
+ * Under POLLY_CONTRACTS=all: throws ContractViolation when false
  *
  * @example
  * messageBus.on("USER_LOGIN", (payload) => {
@@ -16,6 +49,7 @@ export declare function requires(condition: boolean, message?: string): void;
  *
  * In production: No-op (compiled away)
  * In verification: Translated to TLA+ assertion
+ * Under POLLY_CONTRACTS=ensures|all: throws ContractViolation when false
  *
  * @example
  * messageBus.on("USER_LOGIN", (payload) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fairfox/polly",
-  "version": "0.91.0",
+  "version": "0.92.0",
   "private": false,
   "type": "module",
   "description": "Multi-execution-context framework with reactive state and cross-context messaging for Chrome extensions, PWAs, and worker-based applications",
@@ -58,10 +58,6 @@
       "import": "./dist/tools/verify/src/config.js",
       "types": "./dist/tools/verify/src/config.d.ts"
     },
-    "./stryker": {
-      "import": "./dist/tools/verify/src/stryker/index.js",
-      "types": "./dist/tools/verify/src/stryker/index.d.ts"
-    },
     "./mutate": {
       "import": "./dist/tools/mutate/src/index.js",
       "types": "./dist/tools/mutate/src/index.d.ts"
@@ -155,7 +151,7 @@
     "build:registry": "bun scripts/build-polly-ui-registry.ts",
     "build:full-featured": "bun run scripts/build-user-extension.ts ../../examples/full-featured",
     "build:full-featured:prod": "bun run scripts/build-user-extension.ts ../../examples/full-featured --prod",
-    "typecheck": "bunx tsc --noEmit && bun run --cwd tests typecheck",
+    "typecheck": "bun --check && bun run --cwd tests typecheck",
     "typecheck:tests": "bun run --cwd tests typecheck",
     "lint": "biome check .",
     "lint:fix": "biome check --write .",
@@ -172,43 +168,41 @@
     "publish:public": "bun run scripts/publish.ts"
   },
   "devDependencies": {
-    "@automerge/automerge-repo": "2.5.5",
-    "@automerge/automerge-repo-network-websocket": "2.5.5",
-    "@automerge/automerge-repo-storage-indexeddb": "2.5.5",
-    "@automerge/automerge-repo-storage-nodefs": "2.5.5",
-    "@babel/parser": "7.29.3",
-    "@babel/traverse": "7.29.0",
-    "@biomejs/biome": "2.4.14",
-    "@stryker-mutator/api": "9.6.1",
+    "@automerge/automerge-repo": "2.5.6",
+    "@automerge/automerge-repo-network-websocket": "2.5.6",
+    "@automerge/automerge-repo-storage-indexeddb": "2.5.6",
+    "@automerge/automerge-repo-storage-nodefs": "2.5.6",
+    "@biomejs/biome": "2.5.15",
     "@elysiajs/eden": "1.4.9",
-    "@preact/signals": "2.9.0",
-    "@preact/signals-core": "1.14.2",
-    "@types/bun": "1.3.13",
-    "@types/chrome": "0.1.40",
-    "@types/pixelmatch": "5.2.6",
+    "@preact/signals": "2.11.3",
+    "@preact/signals-core": "1.14.4",
+    "@types/bun": "1.4.3",
+    "@types/chrome": "0.3.5",
+    "@types/pixelmatch": "7.1.0",
     "@types/pngjs": "6.0.5",
-    "@types/ws": "8.18.1",
-    "dompurify": "3.4.14",
-    "elysia": "1.4.28",
-    "fast-check": "4.7.0",
-    "marked": "18.0.3",
-    "pixelmatch": "7.2.0",
+    "@types/ws": "8.18.2",
+    "dompurify": "3.4.17",
+    "elysia": "1.4.30",
+    "fast-check": "4.10.2",
+    "marked": "18.1.1",
+    "pixelmatch": "8.0.0",
     "pngjs": "7.0.0",
-    "preact": "10.29.1",
-    "puppeteer": "24.42.0",
-    "tweetnacl": "1.0.3",
-    "typescript": "6.0.3"
+    "preact": "10.29.8",
+    "puppeteer": "25.14.0",
+    "tweetnacl": "1.0.3"
   },
   "engines": {
-    "bun": ">=1.2.0"
+    "bun": ">=1.4.3"
   },
   "dependencies": {
-    "@cucumber/gherkin": "40.0.0",
-    "@cucumber/messages": "33.0.2",
-    "ts-morph": "28.0.0"
+    "@cucumber/gherkin": "42.0.1",
+    "@cucumber/messages": "34.2.1",
+    "oxc-parser": "0.137.0",
+    "typescript-7": "npm:typescript@7.0.2",
+    "ts-morph": "28.0.0",
+    "weapon-regex": "1.3.6"
   },
   "peerDependencies": {
-    "typescript": ">= 5.9.3",
     "preact": "^10.28.1",
     "@preact/signals": "^2.5.1",
     "@preact/signals-core": "^1.14.0",
@@ -224,13 +218,9 @@
     "werift": ">= 0.19.0",
     "@roamhq/wrtc": ">= 0.8.0",
     "marked": ">= 12.0.0",
-    "dompurify": ">= 3.0.0",
-    "@stryker-mutator/api": ">= 9.0.0"
+    "dompurify": ">= 3.0.0"
   },
   "peerDependenciesMeta": {
-    "@stryker-mutator/api": {
-      "optional": true
-    },
     "elysia": {
       "optional": true
     },

package/dist/tools/verify/src/stryker/index.d.ts

@@ -1,32 +0,0 @@
-import type { Ignorer, NodePath } from "@stryker-mutator/api/ignore";
-import { PluginKind } from "@stryker-mutator/api/plugin";
-/**
- * The polly verify primitives whose argument expressions are runtime no-ops.
- * A mutation anywhere inside a call to one of these cannot be killed by a test,
- * so its mutants are excluded from scoring.
- */
-export declare const VERIFY_PRIMITIVES: ReadonlySet<string>;
-/** The Stryker plugin name consumers reference in `ignorers`. */
-export declare const POLLY_VERIFY_IGNORER_NAME = "polly-verify";
-/**
- * A Stryker `Ignore` plugin. Stryker calls `shouldIgnore` on entering each AST
- * node; returning a message marks that node — and every descendant, until the
- * node is left — as ignored. So matching the verify `CallExpression` itself
- * covers its condition and message arguments in one shot.
- */
-export declare class PollyVerifyIgnorer implements Ignorer {
-    private readonly primitives;
-    constructor(primitives?: ReadonlySet<string>);
-    shouldIgnore(path: NodePath): string | undefined;
-}
-/** The plugin array Stryker reads when this module is listed in `plugins`. */
-export declare const strykerPlugins: import("@stryker-mutator/api/plugin").FactoryPlugin<PluginKind.Ignore, ["options"]>[];
-/**
- * A partial Stryker config that wires up the ignorer. Spread it into a
- * `stryker.conf.mjs` default export, or replicate its two keys in JSON.
- */
-export declare const pollyStrykerPreset: {
-    readonly plugins: readonly ["@fairfox/polly/stryker"];
-    readonly ignorers: readonly ["polly-verify"];
-};
-export default pollyStrykerPreset;

package/dist/tools/verify/src/stryker/index.js

@@ -1,86 +0,0 @@
-// tools/verify/src/stryker/index.ts
-import {
-  commonTokens,
-  declareFactoryPlugin,
-  PluginKind,
-  tokens
-} from "@stryker-mutator/api/plugin";
-var VERIFY_PRIMITIVES = new Set([
-  "requires",
-  "ensures",
-  "invariant",
-  "stateConstraint",
-  "forAllPeers",
-  "somePeer"
-]);
-var POLLY_VERIFY_IGNORER_NAME = "polly-verify";
-function isCallExpressionPath(path) {
-  return "isCallExpression" in path && typeof path.isCallExpression === "function";
-}
-function isBabelIdentifier(callee) {
-  return callee.type === "Identifier";
-}
-function isBabelMemberExpression(callee) {
-  return callee.type === "MemberExpression";
-}
-function calleeName(callee) {
-  if (!callee)
-    return;
-  if (isBabelIdentifier(callee)) {
-    return callee.name;
-  }
-  if (isBabelMemberExpression(callee)) {
-    if (!callee.computed && callee.property.type === "Identifier") {
-      return callee.property.name;
-    }
-  }
-  return;
-}
-
-class PollyVerifyIgnorer {
-  primitives;
-  constructor(primitives = VERIFY_PRIMITIVES) {
-    this.primitives = primitives;
-  }
-  shouldIgnore(path) {
-    if (!isCallExpressionPath(path) || !path.isCallExpression()) {
-      return;
-    }
-    const name = calleeName(path.node.callee);
-    if (name && this.primitives.has(name)) {
-      return `Inside polly's ${name}(...) — a runtime no-op (compiled away in production, ` + `translated to a TLA+ assertion in verification). No test can observe or kill ` + `mutations here, so they are excluded from the score (polly#143).`;
-    }
-    return;
-  }
-}
-function isEnabled(options) {
-  const polly = options["polly"];
-  if (typeof polly !== "object" || polly === null)
-    return true;
-  return !("excludeVerifyCallsites" in polly) || polly.excludeVerifyCallsites !== false;
-}
-var NOOP_IGNORER = { shouldIgnore: () => {
-  return;
-} };
-function pollyVerifyIgnorerFactory(options) {
-  return isEnabled(options) ? new PollyVerifyIgnorer : NOOP_IGNORER;
-}
-pollyVerifyIgnorerFactory.inject = tokens(commonTokens.options);
-var strykerPlugins = [
-  declareFactoryPlugin(PluginKind.Ignore, POLLY_VERIFY_IGNORER_NAME, pollyVerifyIgnorerFactory)
-];
-var pollyStrykerPreset = {
-  plugins: ["@fairfox/polly/stryker"],
-  ignorers: [POLLY_VERIFY_IGNORER_NAME]
-};
-var stryker_default = pollyStrykerPreset;
-export {
-  POLLY_VERIFY_IGNORER_NAME,
-  PollyVerifyIgnorer,
-  VERIFY_PRIMITIVES,
-  stryker_default as default,
-  pollyStrykerPreset,
-  strykerPlugins
-};
-
-//# debugId=E1FCF7B89389BBE564756E2164756E21

package/dist/tools/verify/src/stryker/index.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../tools/verify/src/stryker/index.ts"],
-  "sourcesContent": [
-    "// Stryker mutation-testing ignorer for polly's verify primitives (polly#143).\n//\n// `requires`, `ensures`, `invariant`, `stateConstraint`, `forAllPeers`, and\n// `somePeer` are runtime no-ops: in production they compile away, in\n// verification they translate to TLA+ assertions. Nothing observes their\n// condition or message argument at test runtime, so EVERY mutation inside one\n// of these callsites is guaranteed to survive — a string-literal flip in an\n// `ensures(...)` message, an `===` → equality mutation in a `requires(...)`\n// condition. On a downstream project mutating six state-machine specs this\n// dragged the mutation score down to 21%, all of it noise rather than real\n// test-coverage gaps.\n//\n// Polly is the right place to ship this knowledge: it knows which of its\n// primitives are no-ops. This module is a Stryker `Ignore` plugin that marks\n// every mutant inside a verify callsite as ignored, plus a small config preset\n// consumers can spread into their `stryker.conf.*`.\n//\n// Usage (stryker.conf.json):\n//\n//   {\n//     \"plugins\": [\"@fairfox/polly/stryker\"],\n//     \"ignorers\": [\"polly-verify\"]\n//   }\n//\n// Or, in stryker.conf.mjs:\n//\n//   import pollyStrykerPreset from \"@fairfox/polly/stryker\";\n//   export default { ...pollyStrykerPreset, mutate: [\"src/**/*.ts\"] };\n//\n// Set `\"polly\": { \"excludeVerifyCallsites\": false }` to keep the plugin listed\n// but disable the ignoring (e.g. in a shared base config).\n\nimport type { StrykerOptions } from \"@stryker-mutator/api/core\";\nimport type { Ignorer, NodePath } from \"@stryker-mutator/api/ignore\";\nimport {\n  commonTokens,\n  declareFactoryPlugin,\n  PluginKind,\n  tokens,\n} from \"@stryker-mutator/api/plugin\";\n\n/**\n * The polly verify primitives whose argument expressions are runtime no-ops.\n * A mutation anywhere inside a call to one of these cannot be killed by a test,\n * so its mutants are excluded from scoring.\n */\nexport const VERIFY_PRIMITIVES: ReadonlySet<string> = new Set([\n  \"requires\",\n  \"ensures\",\n  \"invariant\",\n  \"stateConstraint\",\n  \"forAllPeers\",\n  \"somePeer\",\n]);\n\n/** The Stryker plugin name consumers reference in `ignorers`. */\nexport const POLLY_VERIFY_IGNORER_NAME = \"polly-verify\";\n\n// The Stryker API types `NodePath` as an empty interface; at runtime it is a\n// Babel NodePath. We narrow only the surface we touch — `isCallExpression()`\n// and `node.callee` — without pulling in @babel/types as a dependency.\ninterface BabelIdentifier {\n  type: \"Identifier\";\n  name: string;\n}\ninterface BabelMemberExpression {\n  type: \"MemberExpression\";\n  computed: boolean;\n  property: { type: string; name?: string };\n}\ntype BabelCallee = BabelIdentifier | BabelMemberExpression | { type: string };\ninterface CallExpressionPath extends NodePath {\n  isCallExpression(): boolean;\n  node: { callee?: BabelCallee };\n}\n\n/** Narrow the opaque `NodePath` to the Babel surface we touch. */\nfunction isCallExpressionPath(path: NodePath): path is CallExpressionPath {\n  return \"isCallExpression\" in path && typeof path.isCallExpression === \"function\";\n}\n\n/**\n * Resolve the simple name of a call's callee, covering both a bare call\n * (`ensures(...)`) and a member call (`verify.ensures(...)` / `polly.ensures(...)`).\n * Computed member access (`obj[\"ensures\"](...)`) is intentionally not matched —\n * it cannot be resolved statically and is not a pattern polly emits.\n */\nfunction isBabelIdentifier(callee: BabelCallee): callee is BabelIdentifier {\n  return callee.type === \"Identifier\";\n}\n\nfunction isBabelMemberExpression(callee: BabelCallee): callee is BabelMemberExpression {\n  return callee.type === \"MemberExpression\";\n}\n\nfunction calleeName(callee: BabelCallee | undefined): string | undefined {\n  if (!callee) return undefined;\n  if (isBabelIdentifier(callee)) {\n    return callee.name;\n  }\n  if (isBabelMemberExpression(callee)) {\n    if (!callee.computed && callee.property.type === \"Identifier\") {\n      return callee.property.name;\n    }\n  }\n  return undefined;\n}\n\n/**\n * A Stryker `Ignore` plugin. Stryker calls `shouldIgnore` on entering each AST\n * node; returning a message marks that node — and every descendant, until the\n * node is left — as ignored. So matching the verify `CallExpression` itself\n * covers its condition and message arguments in one shot.\n */\nexport class PollyVerifyIgnorer implements Ignorer {\n  constructor(private readonly primitives: ReadonlySet<string> = VERIFY_PRIMITIVES) {}\n\n  shouldIgnore(path: NodePath): string | undefined {\n    if (!isCallExpressionPath(path) || !path.isCallExpression()) {\n      return undefined;\n    }\n    const name = calleeName(path.node.callee);\n    if (name && this.primitives.has(name)) {\n      return (\n        `Inside polly's ${name}(...) — a runtime no-op (compiled away in production, ` +\n        `translated to a TLA+ assertion in verification). No test can observe or kill ` +\n        `mutations here, so they are excluded from the score (polly#143).`\n      );\n    }\n    return undefined;\n  }\n}\n\n/** Reads `polly.excludeVerifyCallsites` (default: enabled) off Stryker options. */\nfunction isEnabled(options: StrykerOptions): boolean {\n  const polly = options[\"polly\"];\n  if (typeof polly !== \"object\" || polly === null) return true;\n  return !(\"excludeVerifyCallsites\" in polly) || polly.excludeVerifyCallsites !== false;\n}\n\n// When disabled the plugin still loads but ignores nothing, so a shared config\n// can list it unconditionally and individual projects opt out via options.\nconst NOOP_IGNORER: Ignorer = { shouldIgnore: () => undefined };\n\nfunction pollyVerifyIgnorerFactory(options: StrykerOptions): Ignorer {\n  return isEnabled(options) ? new PollyVerifyIgnorer() : NOOP_IGNORER;\n}\npollyVerifyIgnorerFactory.inject = tokens(commonTokens.options);\n\n/** The plugin array Stryker reads when this module is listed in `plugins`. */\nexport const strykerPlugins = [\n  declareFactoryPlugin(PluginKind.Ignore, POLLY_VERIFY_IGNORER_NAME, pollyVerifyIgnorerFactory),\n];\n\n/**\n * A partial Stryker config that wires up the ignorer. Spread it into a\n * `stryker.conf.mjs` default export, or replicate its two keys in JSON.\n */\nexport const pollyStrykerPreset = {\n  plugins: [\"@fairfox/polly/stryker\"],\n  ignorers: [POLLY_VERIFY_IGNORER_NAME],\n} as const;\n\n// biome-ignore lint/style/noDefaultExport: ergonomic `import preset from \"@fairfox/polly/stryker\"`\nexport default pollyStrykerPreset;\n"
-  ],
-  "mappings": ";AAkCA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYO,IAAM,oBAAyC,IAAI,IAAI;AAAA,EAC5D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,4BAA4B;AAqBzC,SAAS,oBAAoB,CAAC,MAA4C;AAAA,EACxE,OAAO,sBAAsB,QAAQ,OAAO,KAAK,qBAAqB;AAAA;AASxE,SAAS,iBAAiB,CAAC,QAAgD;AAAA,EACzE,OAAO,OAAO,SAAS;AAAA;AAGzB,SAAS,uBAAuB,CAAC,QAAsD;AAAA,EACrF,OAAO,OAAO,SAAS;AAAA;AAGzB,SAAS,UAAU,CAAC,QAAqD;AAAA,EACvE,IAAI,CAAC;AAAA,IAAQ;AAAA,EACb,IAAI,kBAAkB,MAAM,GAAG;AAAA,IAC7B,OAAO,OAAO;AAAA,EAChB;AAAA,EACA,IAAI,wBAAwB,MAAM,GAAG;AAAA,IACnC,IAAI,CAAC,OAAO,YAAY,OAAO,SAAS,SAAS,cAAc;AAAA,MAC7D,OAAO,OAAO,SAAS;AAAA,IACzB;AAAA,EACF;AAAA,EACA;AAAA;AAAA;AASK,MAAM,mBAAsC;AAAA,EACpB;AAAA,EAA7B,WAAW,CAAkB,aAAkC,mBAAmB;AAAA,IAArD;AAAA;AAAA,EAE7B,YAAY,CAAC,MAAoC;AAAA,IAC/C,IAAI,CAAC,qBAAqB,IAAI,KAAK,CAAC,KAAK,iBAAiB,GAAG;AAAA,MAC3D;AAAA,IACF;AAAA,IACA,MAAM,OAAO,WAAW,KAAK,KAAK,MAAM;AAAA,IACxC,IAAI,QAAQ,KAAK,WAAW,IAAI,IAAI,GAAG;AAAA,MACrC,OACE,kBAAkB,+DAClB,kFACA;AAAA,IAEJ;AAAA,IACA;AAAA;AAEJ;AAGA,SAAS,SAAS,CAAC,SAAkC;AAAA,EACnD,MAAM,QAAQ,QAAQ;AAAA,EACtB,IAAI,OAAO,UAAU,YAAY,UAAU;AAAA,IAAM,OAAO;AAAA,EACxD,OAAO,EAAE,4BAA4B,UAAU,MAAM,2BAA2B;AAAA;AAKlF,IAAM,eAAwB,EAAE,cAAc,MAAG;AAAA,EAAG;AAAA,EAAU;AAE9D,SAAS,yBAAyB,CAAC,SAAkC;AAAA,EACnE,OAAO,UAAU,OAAO,IAAI,IAAI,qBAAuB;AAAA;AAEzD,0BAA0B,SAAS,OAAO,aAAa,OAAO;AAGvD,IAAM,iBAAiB;AAAA,EAC5B,qBAAqB,WAAW,QAAQ,2BAA2B,yBAAyB;AAC9F;AAMO,IAAM,qBAAqB;AAAA,EAChC,SAAS,CAAC,wBAAwB;AAAA,EAClC,UAAU,CAAC,yBAAyB;AACtC;AAGA,IAAe;",
-  "debugId": "E1FCF7B89389BBE564756E2164756E21",
-  "names": []
-}