@systemfsoftware/vitest 1.0.0 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @systemfsoftware/vitest
 
+## 2.0.0
+
+### Major Changes
+
+- Property failures (`PropertyRefuted`, `NonBooleanVerdict`, `CoverageBelowMinimum`, `VacuousProperty`, `SelfModelLaw`, `SeedStoreUnreadable`, `ReplayUnreadable`) are exported tagged errors whose fields (property name, site, seed, runs, witness, `replay` text) reach reporters, replacing the `detail` prose. A provided budget `seed` now gives each property its own stable seed; failing seeds are recorded in `__property_seeds__/<test file>.jsonl` and replayed first; vitest-config sets `record: false` in CI and Stryker.
+
+  - To keep one literal seed, set `arbitrary: { seed }` on the property.
+  - Commit `__property_seeds__` files; a case that must always run belongs in the test source.
+  - Catch a self-model law as `SelfModelLaw`, no longer `VacuousProperty`.
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -171,16 +171,78 @@ it.prop(
 
 ### The constant-impostor gate
 
-After a property holds, it runs again against a constant impostor of its subject — a fake that returns the first output forever, whatever the input. Each subject is judged across every property in its file, when the file ends. If nothing in the file refutes the impostor, the file fails `VacuousProperty`:
+After a property holds, it runs again against a constant impostor of its subject — a fake that returns the first output forever, whatever the input. Each subject is judged across every property in its file, when the file ends. If nothing in the file refutes the impostor, the file fails with `VacuousProperty`:
 
-> sort: no property in this file refuted the constant impostor of \`sort\`, so nothing here pins it down. … Laws that only relate outputs to each other (additivity, idempotence, commutativity, round trips through the subject) hold for such constants. Pin the output to the input: compare against an independent model (\`subject(x)\` equals a straightforward reimplementation), or conjoin a base case (\`subject([one])\` equals its known value). Also check that the body calls the \`subject\` it was given, not the imported implementation.
+```ts
+export interface VacuousProperty {
+  readonly _tag: 'VacuousProperty'
+  readonly subjects: ReadonlyArray<{
+    readonly label: string
+    readonly properties: ReadonlyArray<{
+      readonly property: { name: string; site: string | null; seed: number; runs: number }
+      readonly frozen:
+        | { _tag: 'Frozen'; outputs: ReadonlyArray<{ member: string; output: { rendered: string; value: unknown } }> }
+        | { _tag: 'NeverCalled' }
+    }>
+  }>
+  readonly exempt: ReadonlyArray<{ name: string; kind: string }>
+  readonly replay: string
+}
+```
+
+The `frozen` union distinguishes a subject whose impostor was called (`Frozen`, with rendered outputs for each member) from one never called during the vacuity check (`NeverCalled`). Replay the same verdict with:
+
+```bash
+CONFORMANCE_REPLAY="property=<hash>;seed=<n>;runs=<n>|..." pnpm test
+```
+
+Other property failures are exported from the package root as tagged errors — each carries its own fields:
+
+- **`PropertyRefuted`**: `property` (name, site, seed, runs), `counterexample` (rendered, value), `shrinks`, `replay`
+- **`NonBooleanVerdict`**: `property`, `drawn` (rendered, value), `returned` (array of kinds), `replay`
+- **`CoverageBelowMinimum`**: `property`, `classes` (array of {label, hits, runs, minimum}), `replay`
+- **`SelfModelLaw`**: `name`, `site` — the law compared the subject to itself
+- **`SeedStoreUnreadable`**: `file`, `line`, `detail` — a seed store file's line could not be decoded
+- **`ReplayUnreadable`**: `text` — `CONFORMANCE_REPLAY` names neither the kernel's `seed=…;path=…` nor a property entry
 
-`sorting is ordered` alone is vacuous, because a constant empty array is also ordered. A law that pins the output to an input refutes the impostor for that subject:
+A reporter receives every field on the raw error, so a script or agent narrows by `_tag` and reads the fields directly without parsing messages:
 
 ```ts
-it.law.model('agree with insertion sort', { of: [S.Array(S.Int)], subject: sort }, insertionSort)
+if (error._tag === 'VacuousProperty') {
+  for (const subject of error.subjects) {
+    for (const run of subject.properties) {
+      console.log(run.property.name, run.frozen._tag, run.property.seed)
+    }
+  }
+}
 ```
 
+### Seeds and the seed store
+
+A provided budget asks for derandomized runs by carrying a `seed`. Each property then gets its own stable seed derived from that seed and its identity, so different properties draw different inputs and the same property draws the same inputs in every process and on every machine:
+
+```ts
+// vitest.config.ts
+export default defineConfig({
+  test: { provide: { '@systemfsoftware/vitest:property-check': { runs: 30, seed: 1 } } },
+})
+```
+
+**Seed precedence**: a property's own `arbitrary: { seed: 7 }` wins over a provided seed. With a provided `seed`, the engine hashes it (FNV-1a) with the property's identity — its package, its file relative to the Vitest project root, and its full test name. With neither, each property draws from a fresh random seed. Every failure reports the seed it ran with.
+
+**Migration**: code that relied on a provided seed making every property share one stream must set `arbitrary: { seed: <literal> }` on each property that needs a literal seed.
+
+**The seed store and recording**: failing seeds are automatically saved to a checked-in JSON Lines file `__property_seeds__/<test file>.jsonl` beside the test file. Each line holds either:
+
+- Refuted: `{ "_tag": "Refuted", "property": "full test name", "seed": 42, "attempt": 5, "size": 3, "path": [0,1], "failure": "ReturnedFalse" }`
+- NonBoolean: `{ "_tag": "NonBoolean", "property": "full test name", "seed": 42, "runs": 100 }`
+
+Recorded seeds replay before novel draws on every run, whatever the budget. Only a refuted or non-boolean failure writes, and only in a run that is not derandomized and does not set `record: false`; the shared config sets `record: false` in CI and in Stryker workers. Commit seed store updates like snapshot files.
+
+**Generator changes**: if a property's generator changes, its recorded seeds may no longer produce their old counterexamples, so the failure stops reproducing. Cases that must always run belong in the test source itself, not in the seed store.
+
+**The `record` option**: `{ runs: 30, record: false }` opts out of writing seeds for a run; the engine still reads and replays existing seeds.
+
 ### Law kinds
 
 `it.law.model` (an independent oracle), `it.law.metamorphic` (the input transform), `it.law.roundTrip` (the encode/decode pair) and `it.law.invariant` (a predicate on the output) are sugar over the same gate.

package/dist/engine-D7Q6-BxD.d.ts

@@ -0,0 +1,503 @@
+
+import * as Cause from "effect/Cause";
+import * as Effect$1 from "effect/Effect";
+import * as Schema$1 from "effect/Schema";
+import * as Tracer from "effect/Tracer";
+import { Schema } from "effect";
+import * as Arbitrary from "effect/Arbitrary";
+//#endregion
+//#region src/internal/errors.schema.d.ts
+/**
+ * The contract rules a rendered failure record can break (R10, KTD7).
+ *
+ * @internal
+ */
+declare const Breach: Schema.Literals<readonly ["R1", "R2", "R6"]>;
+/** @internal */
+type Breach = typeof Breach.Type;
+//#endregion
+//#region src/internal/property/error.schema.d.ts
+/**
+ * One witness: the text the renderer prints for a value, and a JSON-safe projection of the same traversal (R3, KD7).
+ *
+ * @internal
+ */
+declare const Witness: Schema.Struct<{
+  readonly rendered: Schema.String;
+  readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+}>;
+/** @internal */
+type Witness = typeof Witness.Type;
+/**
+ * One property involved in a failure: its full name, its declaration site, its seed and its run count (R2).
+ *
+ * @internal
+ */
+declare const PropertyRun: Schema.Struct<{
+  readonly name: Schema.String;
+  readonly site: Schema.NullOr<Schema.String>;
+  readonly seed: Schema.brand<Schema.Int, "PropertySeed">;
+  readonly runs: Schema.brand<Schema.Int, "PropertyRunCount">;
+}>;
+/** @internal */
+type PropertyRun = typeof PropertyRun.Type;
+declare const PropertyRefuted_base: Schema.Class<PropertyRefuted, Schema.TaggedStruct<"PropertyRefuted", {
+  readonly property: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly site: Schema.NullOr<Schema.String>;
+    readonly seed: Schema.brand<Schema.Int, "PropertySeed">;
+    readonly runs: Schema.brand<Schema.Int, "PropertyRunCount">;
+  }>;
+  readonly counterexample: Schema.Struct<{
+    readonly rendered: Schema.String;
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  }>;
+  readonly shrinks: Schema.brand<Schema.Int, "PropertyShrinkCount">;
+  readonly replay: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A falsified property: the property that ran, the shrunk counterexample the generator settled on, and how many
+ * shrink steps it took to reach it (R2-R4).
+ *
+ * @internal
+ */
+declare class PropertyRefuted extends PropertyRefuted_base {
+  get message(): string;
+}
+declare const NonBooleanVerdict_base: Schema.Class<NonBooleanVerdict, Schema.TaggedStruct<"NonBooleanVerdict", {
+  readonly property: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly site: Schema.NullOr<Schema.String>;
+    readonly seed: Schema.brand<Schema.Int, "PropertySeed">;
+    readonly runs: Schema.brand<Schema.Int, "PropertyRunCount">;
+  }>;
+  readonly drawn: Schema.Struct<{
+    readonly rendered: Schema.String;
+    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  }>;
+  readonly returned: Schema.$Array<Schema.Literals<readonly ["undefined", "object", "boolean", "number", "bigint", "string", "symbol", "function", "effect"]>>;
+  readonly replay: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A verdict that was not a literal boolean: the property that ran, the first drawn values whose verdict was not a
+ * boolean, and every kind of value the property returned (R4).
+ *
+ * @internal
+ */
+declare class NonBooleanVerdict extends NonBooleanVerdict_base {
+  get message(): string;
+}
+declare const CoverageBelowMinimum_base: Schema.Class<CoverageBelowMinimum, Schema.TaggedStruct<"CoverageBelowMinimum", {
+  readonly property: Schema.Struct<{
+    readonly name: Schema.String;
+    readonly site: Schema.NullOr<Schema.String>;
+    readonly seed: Schema.brand<Schema.Int, "PropertySeed">;
+    readonly runs: Schema.brand<Schema.Int, "PropertyRunCount">;
+  }>;
+  readonly classes: Schema.$Array<Schema.Struct<{
+    readonly label: Schema.String;
+    readonly hits: Schema.Int;
+    readonly runs: Schema.Int;
+    readonly minimum: Schema.Finite;
+  }>>;
+  readonly replay: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A property whose declared coverage classes stayed under their minima: the property and the failed classes, in
+ * declaration order (R7).
+ *
+ * @internal
+ */
+declare class CoverageBelowMinimum extends CoverageBelowMinimum_base {
+  get message(): string;
+}
+declare const SelfModelLaw_base: Schema.Class<SelfModelLaw, Schema.TaggedStruct<"SelfModelLaw", {
+  readonly name: Schema.String;
+  readonly site: Schema.NullOr<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A model law given the subject itself as its oracle, so it compares nothing (R13).
+ *
+ * @internal
+ */
+declare class SelfModelLaw extends SelfModelLaw_base {
+  get message(): string;
+}
+declare const SeedStoreUnreadable_base: Schema.Class<SeedStoreUnreadable, Schema.TaggedStruct<"SeedStoreUnreadable", {
+  readonly file: Schema.String;
+  readonly line: Schema.Int;
+  readonly detail: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A seed-store line that could not be decoded (R16, KTD6).
+ *
+ * @internal
+ */
+declare class SeedStoreUnreadable extends SeedStoreUnreadable_base {
+  get message(): string;
+}
+declare const VacuousProperty_base: Schema.Class<VacuousProperty, Schema.TaggedStruct<"VacuousProperty", {
+  readonly subjects: Schema.$Array<Schema.Struct<{
+    readonly label: Schema.String;
+    readonly properties: Schema.$Array<Schema.Struct<{
+      readonly property: Schema.Struct<{
+        readonly name: Schema.String;
+        readonly site: Schema.NullOr<Schema.String>;
+        readonly seed: Schema.brand<Schema.Int, "PropertySeed">;
+        readonly runs: Schema.brand<Schema.Int, "PropertyRunCount">;
+      }>;
+      readonly frozen: Schema.Union<readonly [Schema.TaggedStruct<"Frozen", {
+        readonly outputs: Schema.$Array<Schema.Struct<{
+          readonly member: Schema.String;
+          readonly output: Schema.Struct<{
+            readonly rendered: Schema.String;
+            readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+          }>;
+        }>>;
+      }>, Schema.TaggedStruct<"NeverCalled", {}>]>;
+    }>>;
+  }>>;
+  readonly exempt: Schema.$Array<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly kind: Schema.String;
+  }>>;
+  readonly replay: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Thrown at file end when no property in the file refuted a subject's constant impostor (R12, R5, R6).
+ *
+ * @internal
+ */
+declare class VacuousProperty extends VacuousProperty_base {
+  get message(): string;
+}
+declare const ReplayUnreadable_base: Schema.Class<ReplayUnreadable, Schema.TaggedStruct<"ReplayUnreadable", {
+  readonly text: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** @internal */
+declare class ReplayUnreadable extends ReplayUnreadable_base {
+  get message(): string;
+}
+//#endregion
+//#region src/internal/failure-record.d.ts
+/** A value the renderer narrows rather than assumes. */
+type Opaque$1<A = unknown> = A;
+/**
+ * A value a recorded span attribute or a replay path carries. Structured values stay structured on the span
+ * (KTD2); the renderer decides the text.
+ *
+ * @internal
+ */
+type AttributeValue = string | number | boolean | null | ReadonlyArray<AttributeValue> | {
+  readonly [key: string]: AttributeValue;
+};
+/**
+ * The test a failure happened in, as Vitest knows it. `file` is the path the rerun command names, so a caller
+ * that holds an absolute path derives the repo-relative one before handing it over.
+ *
+ * @internal
+ */
+interface TestIdentity {
+  /**
+   * The npm package the test file belongs to, e.g. `@systemfsoftware/effect-readiness`. Empty when the run
+   * provided no name: the rerun command then drops its `pnpm --filter` prefix and runs from the package
+   * directory, which is not a breach (R6).
+   */
+  readonly package: string;
+  /** The test file, as the rerun command writes it. */
+  readonly file: string;
+  /** The scenario name the rerun command filters on with `-t`. */
+  readonly name: string;
+}
+/**
+ * The value a generator chose a run by: the kernel's seed and decision path, or a property counterexample's
+ * seed and path. A path without a seed is a replay value offered for a baseline run, which R6 refuses (KTD5).
+ *
+ * @internal
+ */
+interface ReplayValue {
+  /** The generator's seed, or `undefined` when only a path was recorded. */
+  readonly seed: number | undefined;
+  /** The decisions the generator chose, in order; a decision is the index the scheduler picked (KTD5). */
+  readonly path: ReadonlyArray<number>;
+}
+/**
+ * A contract rule a rendered record breaks; the runner refuses such a record (R10, KTD7).
+ *
+ * @internal
+ */
+/**
+ * What a rendered failure gives Vitest: the tag the error carries, the record text, and the rules it breaks.
+ *
+ * @internal
+ */
+interface FailureRecord {
+  /** The headline's failure tag, e.g. `StepError`; the runner sets it as the thrown error's `name`. */
+  readonly name: string;
+  /** The text Vitest prints as the failure's message. */
+  readonly record: string;
+  /** The contract rules the record breaks: `R1` empty headline, `R2` no location, `R6` replay or rerun. */
+  readonly breaches: ReadonlyArray<Breach>;
+  /**
+   * The raised failure itself when it is one of the property-channel variants, so an in-process corpus run reads
+   * its fields without parsing the record text (R1, R2). Absent for every other failure.
+   */
+  readonly failure?: Opaque$1;
+}
+/**
+ * Everything one failure is rendered from: the failure, its run's spans, the test and the replay value.
+ *
+ * @internal
+ */
+interface FailureRecordInput<E = never> {
+  /** The failure itself: a `Cause`, or the value a program threw or failed with. */
+  readonly failure: Cause.Cause<E> | E;
+  /** Every span the failing run recorded, in creation order. */
+  readonly spans: ReadonlyArray<Tracer.NativeSpan>;
+  /** The test the run belonged to. */
+  readonly identity: TestIdentity;
+  /** The generator that chose this run, or `undefined` on a run no generator chose. */
+  readonly replay: ReplayValue | undefined;
+  /**
+   * The seed the kernel's scheduler chose. The kernel knows its own scheduler, so it hands the note over rather
+   * than the renderer guessing it; a run no scheduler chose renders no note (KTD5).
+   */
+  readonly schedule?: {
+    readonly seed: number;
+  } | undefined;
+  /**
+   * The workspace root the rendered paths are relativized against, provided by the shared config the same way the
+   * package name is. Omitted, paths print absolute.
+   */
+  readonly root?: string | undefined;
+}
+/**
+ * A value `JSON.stringify` carries: the projection a witness travels to a consumer as (R3, KD7).
+ *
+ * @internal
+ */
+type JsonValue = Schema$1.Json;
+/**
+ * The one traversal a value's rendered text and its JSON projection come from (R3, KD7): `rendered` is exactly
+ * `renderValue`'s text, `value` is the same walk with every value JSON cannot carry marked by kind, and a cycle
+ * marks `circular` rather than recursing forever.
+ *
+ * @internal
+ */
+declare const witnessOf: (value: Opaque$1) => Witness;
+/** @internal */
+declare const summaryOf: (value: Opaque$1) => string;
+/**
+ * Renders the record Vitest prints for one spec failure, and the contract rules it breaks.
+ *
+ * Never throws: a `Cause` renders layer by layer, a thrown `Error` renders as one layer, and any other value
+ * renders as itself. The first location the record names is the raising frame — the first stack frame outside
+ * `node_modules` and outside the spec libraries' own `src/` and `dist/` — and when no layer has one, the
+ * innermost failed span's site stands in, or the innermost unfinished cell's decide site for a deadlock (KTD6).
+ *
+ * @internal
+ */
+declare const renderFailureRecord: <E>(input: FailureRecordInput<E>) => FailureRecord;
+/** @internal */
+declare const throwFailureRecord: <E>(input: FailureRecordInput<E>) => never;
+interface TaskLike {
+  readonly name?: string | undefined;
+  readonly fullName?: string | undefined;
+  readonly fullTestName?: string | undefined;
+}
+/** @internal */
+declare const testIdentityOf: (task?: TaskLike | null) => TestIdentity;
+//#endregion
+//#region src/internal/property/defaults.d.ts
+/** @internal The `test.provide` key the shared config fills with this run's tier's check options. */
+declare const checkDefaultsKey = "@systemfsoftware/vitest:property-check";
+/**
+ * The check options a run supplies as its property default, minus `replay`. `record` asks the engine to write a
+ * failing seed to the checked-in seed store, which it does unless a run opts out.
+ *
+ * @internal
+ */
+interface PropertyBudget extends Omit<Arbitrary.CheckOptions, 'replay'> {
+  /** Write failing seeds to the seed store; default true. A derandomized run never writes regardless. */
+  readonly record?: boolean | undefined;
+}
+/** @internal The check options a run supplies as its property default (KTD4). */
+type ProvidedCheckDefaults = PropertyBudget;
+//#endregion
+//#region src/internal/property/impostor.d.ts
+/**
+ * A value the fork hands over without inspecting: an argument to the subject, or one of its outputs.
+ *
+ * @internal
+ */
+type Opaque<A = unknown> = A;
+/**
+ * A function under test: any argument, any output.
+ *
+ * @internal
+ */
+type SubjectFunction = (...values: ReadonlyArray<never>) => Opaque;
+/**
+ * A record of functions under test; every member is replaced by a constant.
+ *
+ * @internal
+ */
+type MemberRecord = {
+  readonly [key: string]: SubjectFunction;
+};
+/**
+ * The function under test, or a record of them.
+ *
+ * @internal
+ */
+type Subject = SubjectFunction | MemberRecord;
+/**
+ * One key the impostor froze and the raw output it answered with: the subject itself, or a record member.
+ *
+ * @internal
+ */
+interface FrozenOutput {
+  readonly member: string;
+  readonly output: Opaque;
+}
+/**
+ * One property's verdict against a subject's impostor: whether the property refuted the fake, the property it
+ * ran, and the raw outputs the fake froze for it.
+ *
+ * @internal
+ */
+interface Refutation {
+  /** `true` when the property falsified for the impostor, so the property does pin the subject down. */
+  readonly refuted: boolean;
+  readonly property: PropertyRun;
+  /** The property's identity hash, so a vacuous verdict's replay text can name it (R9, R11). */
+  readonly identity: number;
+  readonly frozen: ReadonlyArray<FrozenOutput>;
+}
+/**
+ * The R12 repair verdict for one subject no property in the file refuted.
+ *
+ * @internal
+ */
+interface FileLedger {
+  readonly record: (subject: Subject, verdict: Refutation) => void;
+  /** Records a law kind exempt from the gate, so a refusal can list it (R6). */
+  readonly recordExempt: (name: string, kind: string) => void;
+  /** The single refusal when at least one subject is vacuous, or `undefined` when the file holds. */
+  readonly finalise: () => VacuousProperty | undefined;
+}
+declare namespace kinds_d_exports {
+  export { LawApi, LawKind, LawSubject, MetamorphicRelation, deterministicHolds, idempotentHolds, invariantHolds, metamorphicHolds, modelHolds, roundTripHolds, spreadValues };
+}
+/** @internal */
+type LawKind = 'model' | 'metamorphic' | 'roundTrip' | 'invariant' | 'idempotent' | 'deterministic';
+/**
+ * A subject of a law kind: a function of the generated values.
+ *
+ * @internal
+ */
+type LawSubject<G extends Gens, A> = (...values: ReadonlyArray<ElementValues<G>>) => A;
+/**
+ * A metamorphic relation: the input transform, and how the two outputs relate (structural equality by default).
+ *
+ * @internal
+ */
+interface MetamorphicRelation<G extends Gens, A> {
+  readonly transform: (...values: ReadonlyArray<ElementValues<G>>) => Values<G>;
+  readonly relate?: (original: A, transformed: A) => boolean;
+}
+/**
+ * The R13 law surface: four gated kinds and two declared exemptions.
+ *
+ * @internal
+ */
+interface LawApi {
+  readonly model: <const G extends Gens, A, N extends number, S extends LawSubject<G, A>>(name: string, spec: PropertySpec<G, S, N>, oracle: LawSubject<G, A>) => void;
+  readonly metamorphic: <const G extends Gens, A, N extends number, S extends LawSubject<G, A>>(name: string, spec: PropertySpec<G, S, N>, relation: MetamorphicRelation<G, A>) => void;
+  readonly roundTrip: <const G extends Gens, E, N extends number, S extends LawSubject<G, E>>(name: string, spec: PropertySpec<G, S, N>, decode: (encoded: E) => Values<G>) => void;
+  readonly invariant: <const G extends Gens, A, N extends number, S extends LawSubject<G, A>>(name: string, spec: PropertySpec<G, S, N>, holds: (output: A, ...values: ReadonlyArray<ElementValues<G>>) => boolean) => void;
+  readonly idempotent: <const G extends Gens, N extends number, S extends (value: ElementValues<G>) => ElementValues<G>>(name: string, spec: PropertySpec<G, S, N>) => void;
+  readonly deterministic: <const G extends Gens, A, N extends number, S extends LawSubject<G, A>>(name: string, spec: PropertySpec<G, S, N>) => void;
+}
+/**
+ * The generated values as the argument list a law subject is called with.
+ *
+ * @internal
+ */
+declare const spreadValues: <G extends Gens>(values: Values<G>) => ReadonlyArray<ElementValues<G>>;
+/** @internal */
+declare const modelHolds: <G extends Gens, A>(oracle: LawSubject<G, A>) => (subject: LawSubject<G, A>, values: Values<G>) => boolean;
+/** @internal */
+declare const metamorphicHolds: <G extends Gens, A>(relation: MetamorphicRelation<G, A>) => (subject: LawSubject<G, A>, values: Values<G>) => boolean;
+/** @internal */
+declare const roundTripHolds: <G extends Gens, E>(decode: (encoded: E) => Values<G>) => (subject: LawSubject<G, E>, values: Values<G>) => boolean;
+/** @internal */
+declare const invariantHolds: <G extends Gens, A>(holds: (output: A, ...values: ReadonlyArray<ElementValues<G>>) => boolean) => (subject: LawSubject<G, A>, values: Values<G>) => boolean;
+/** @internal */
+declare const idempotentHolds: <G extends Gens>() => (subject: (value: ElementValues<G>) => ElementValues<G>, values: Values<G>) => boolean;
+/** @internal */
+declare const deterministicHolds: <G extends Gens, A>() => (subject: LawSubject<G, A>, values: Values<G>) => boolean;
+declare namespace engine_d_exports {
+  export { ArbitraryInput, CoveragePredicate, ElementValues, Gens, PropApi, PropertyRuntime, PropertySpec, PropertySubject, PropertyTask, Values, makeProperty };
+}
+/** @internal */
+type ArbitraryInput = Schema$1.Top | Arbitrary.Arbitrary<Schema$1.Top['Type']>;
+/** @internal */
+type Gens = ReadonlyArray<ArbitraryInput> | {
+  readonly [key: string]: ArbitraryInput;
+};
+type Generated<I> = I extends Schema$1.Schema<infer T> ? T : I extends Arbitrary.Arbitrary<infer A> ? A : never;
+/** @internal */
+type Values<G extends Gens> = { readonly [K in keyof G]: Generated<G[K]>; };
+/** @internal */
+type ElementValues<G extends Gens> = G extends ReadonlyArray<ArbitraryInput> ? Generated<G[number]> : never;
+/** @internal */
+type PropertySubject = Subject;
+/** @internal */
+type CoveragePredicate<G extends Gens> = (...values: ReadonlyArray<ElementValues<G>>) => boolean;
+type PropertyRuns<N extends number> = number extends N ? number : `${N}` extends `-${bigint}` ? never : `${N}` extends `${bigint}` ? (N extends 0 ? never : N) : never;
+/** @internal */
+interface PropertySpec<G extends Gens, S extends PropertySubject, N extends number> {
+  readonly of: G;
+  readonly subject: S;
+  /**
+   * The property's own run count. Omitted, the configured default applies; when the run provides none,
+   * the built-in default of 100 does.
+   */
+  readonly runs?: N & PropertyRuns<N>;
+  /** Labelled input predicates, each with the minimum share of runs it must see (R14). */
+  readonly cover?: Readonly<Record<string, readonly [CoveragePredicate<G>, number]>>;
+  /** The property's own check options, merged field by field over the provided and built-in defaults. */
+  readonly arbitrary?: Arbitrary.CheckOptions;
+}
+/** @internal */
+interface PropertyTask {
+  /** The property's run-time identity (KTD3): its package, project-relative file and full name. */
+  readonly identity: TestIdentity;
+  /** The absolute path of the test file whose seed store is read and written beside it (KTD6); `null` keeps no store. */
+  readonly filepath: string | null;
+  /** The provided property budget, or `undefined` when the run provided none. */
+  readonly budget: ProvidedCheckDefaults | undefined;
+}
+/** @internal */
+interface PropertyRuntime<R> {
+  /** Registers the property's program; the runtime runs it inside the test it registers, under that test's binding. */
+  readonly register: (name: string, program: (task: PropertyTask) => Effect$1.Effect<void, Cause.Cause<NonBooleanVerdict>, never>) => void;
+  readonly provide: <A, E>(effect: Effect$1.Effect<A, E, R>) => Effect$1.Effect<A, E, never>;
+  /** The file ledger every property of this runtime records its impostor verdict into (R20, KTD10). */
+  readonly ledger: FileLedger;
+}
+/** @internal */
+interface PropApi<R> {
+  readonly prop: <const G extends Gens, S extends PropertySubject, N extends number>(name: string, spec: PropertySpec<G, S, N>, holds: (subject: S, values: Values<G>) => boolean) => void;
+  readonly effectProp: <const G extends Gens, S extends PropertySubject, N extends number, E>(name: string, spec: PropertySpec<G, S, N>, holds: (subject: S, values: Values<G>) => Effect$1.Effect<boolean, E, R>) => void;
+  readonly law: LawApi;
+}
+/**
+ * The property surface over one runtime: `prop`, `effectProp`, and the R13 law kinds routed through the gate.
+ *
+ * @internal
+ */
+declare const makeProperty: <R>(runtime: PropertyRuntime<R>) => PropApi<R>;
+//#endregion
+export { VacuousProperty as A, witnessOf as C, ReplayUnreadable as D, PropertyRefuted as E, Breach as M, __exportAll as N, SeedStoreUnreadable as O, throwFailureRecord as S, NonBooleanVerdict as T, ReplayValue as _, PropertySubject as a, summaryOf as b, LawApi as c, ProvidedCheckDefaults as d, checkDefaultsKey as f, JsonValue as g, FailureRecordInput as h, PropertySpec as i, Witness as j, SelfModelLaw as k, kinds_d_exports as l, FailureRecord as m, Gens as n, Values as o, AttributeValue as p, PropApi as r, engine_d_exports as s, ArbitraryInput as t, PropertyBudget as u, TestIdentity as v, CoverageBelowMinimum as w, testIdentityOf as x, renderFailureRecord as y };