@typecad/cuttlefish 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/safety/runtime/mode-table.js

@@ -0,0 +1,55 @@
+import { emitResultStructs } from "./result-struct.js";
+/** The pin-mode tracking table + accessors. Tree-shaken out unless
+ *  __tc_safety_record_pin_mode appears in the program (registered in
+ *  POLYFILL_HELPER_MAP). */
+export function modeTablePolyfill() {
+    return {
+        kind: "polyfill",
+        id: "safety_mode_table",
+        domain: "embedded",
+        requiredIncludes: [],
+        forwardDeclarations: [],
+        helperStructs: [],
+        helperFunctions: [
+            emitResultStructs(),
+            `
+namespace __tc_safety {
+constexpr uint32_t TC_SAFETY_PIN_TABLE_SIZE = 255U;
+
+enum class TrackedMode : uint32_t {
+  Unknown       = 0x00000000U,
+  Input         = 0x5A5A5A5AU,
+  Output        = 0xA5A5A5A5U,
+  InputPullup   = 0x3C3C3C3CU,
+  InputPulldown = 0xC3C3C3C3U,
+};
+
+// Raw array: unavoidable for O(1) pin-indexed lookup in an embedded shim.
+// Zero-initialized namespace-scope static storage (Unknown = 0U) satisfies
+// M3-2-1 (const-init) and M3-2-4 (trivial static init); no knownPatterns
+// deviation needed (verified in Part A v1).
+TrackedMode g_pin_mode_table[TC_SAFETY_PIN_TABLE_SIZE];
+
+inline void record_pin_mode(uint32_t pin, uint32_t mode) {
+  if (pin < TC_SAFETY_PIN_TABLE_SIZE) {
+    g_pin_mode_table[pin] = static_cast<TrackedMode>(mode);
+  }
+}
+
+inline TrackedMode get_pin_mode(uint32_t pin) {
+  if (pin < TC_SAFETY_PIN_TABLE_SIZE) {
+    return g_pin_mode_table[pin];
+  }
+  return TrackedMode::Unknown;
+}
+}  // namespace __tc_safety
+
+inline void __tc_safety_record_pin_mode(uint32_t pin, uint32_t mode) {
+  __tc_safety::record_pin_mode(pin, mode);
+}
+`.trim(),
+        ],
+        shimMacros: [],
+        dependencies: [],
+    };
+}

package/dist/safety/runtime/polyfills.d.ts

@@ -0,0 +1,6 @@
+import type { RuntimePolyfillIR } from "../../api/index.js";
+/** All safety runtime polyfills, in dependency order (mode table before voter
+ *  and write-verify, safe variable and safe int are standalone). Returned by
+ *  the safety hook's buildPolyfills(); called from buildEmitterContext so each
+ *  polyfill participates in usage-based tree-shaking via filterPolyfillHelpers. */
+export declare function buildSafetyPolyfills(): RuntimePolyfillIR[];

package/dist/safety/runtime/polyfills.js

@@ -0,0 +1,12 @@
+import { modeTablePolyfill } from "./mode-table.js";
+import { voterPolyfill } from "./vote.js";
+import { safeVariablePolyfill } from "./safe-variable.js";
+import { safeIntPolyfill } from "./safe-int.js";
+import { writeVerifyPolyfill } from "./write-verify.js";
+/** All safety runtime polyfills, in dependency order (mode table before voter
+ *  and write-verify, safe variable and safe int are standalone). Returned by
+ *  the safety hook's buildPolyfills(); called from buildEmitterContext so each
+ *  polyfill participates in usage-based tree-shaking via filterPolyfillHelpers. */
+export function buildSafetyPolyfills() {
+    return [modeTablePolyfill(), voterPolyfill(), writeVerifyPolyfill(), safeVariablePolyfill(), safeIntPolyfill()];
+}

package/dist/safety/runtime/result-struct.d.ts

@@ -0,0 +1,11 @@
+/** Returns the C++ enum + struct definitions for the safety runtime.
+ *
+ *  These are emitted by the polyfill as the SINGLE canonical source.
+ *  @typecad/safety is skipped by the graph-builder (like @typecad/ui), so
+ *  its TypeScript source is never parsed into the user program's IR — the
+ *  type-decl emitter never sees the enums. The polyfill provides the
+ *  definitions that both the voter and the user's switch statements
+ *  reference. Works in both single-file and split-file emit modes because
+ *  the polyfill is inlined into the entry file's source, visible to all
+ *  functions in that translation unit. */
+export declare function emitResultStructs(): string;

package/dist/safety/runtime/result-struct.js

@@ -0,0 +1,98 @@
+// C++ source strings for the safety result struct + fault enums. Emitted by
+// the mode-table polyfill (Task 9) BEFORE the voter, so the voter can return
+// a SafeReadResult.
+//
+// AUTOSAR C++14 compliance:
+//  - enum class (A7-2-1)
+//  - fixed-width types (A3-9-1): uint8_t
+//  - no C-style casts (M5-0-7), no malloc (A18-5-10)
+//  - the raw pin table in mode-table.ts is zero-initialized namespace-scope
+//    static storage, satisfying M3-2-1/M3-2-4. No knownPatterns deviation is
+//    expected; if a rule fires anyway, add one (see
+//    docs/superpowers/plans/2026-07-27-safety-package-part-a.md Task 17).
+/** Returns the C++ enum + struct definitions for the safety runtime.
+ *
+ *  These are emitted by the polyfill as the SINGLE canonical source.
+ *  @typecad/safety is skipped by the graph-builder (like @typecad/ui), so
+ *  its TypeScript source is never parsed into the user program's IR — the
+ *  type-decl emitter never sees the enums. The polyfill provides the
+ *  definitions that both the voter and the user's switch statements
+ *  reference. Works in both single-file and split-file emit modes because
+ *  the polyfill is inlined into the entry file's source, visible to all
+ *  functions in that translation unit. */
+export function emitResultStructs() {
+    return `
+enum class SafetyStatus : uint32_t {
+  Ok    = 0x5A5A5A5AU,
+  Fault = 0xA5A5A5A5U,
+};
+
+enum class SafetyFaultCategory : uint32_t {
+  Ok            = 0x3C3C3C3CU,
+  Signal        = 0x5A5A5A5AU,
+  Integrity     = 0xA5A5A5A5U,
+  Timing        = 0xC3C3C3C3U,
+  System        = 0x55AA55AAU,
+  Configuration = 0xAA55AA55U,
+};
+
+enum class SafetyFaultCode : uint32_t {
+  Ok               = 0x3C3C3C3CU,
+  VoteDisagreement = 0x5A5A5A5AU,
+  StuckHigh        = 0xA5A5A5A5U,
+  StuckLow         = 0xC3C3C3C3U,
+  PinModeMismatch  = 0x55AA55AAU,
+  PinModeUnknown   = 0xAA55AA55U,
+  WriteMismatch    = 0x3C5AA5C3U,
+};
+
+struct SafeReadResult {
+  SafetyStatus status;
+  uint32_t value;
+  SafetyFaultCategory category;
+  SafetyFaultCode code;
+
+  // Chainable result handlers. Each calls the handler at runtime when its
+  // condition matches, then returns *this so chains compose and the result
+  // stays inspectable afterward. Template F&& accepts the inline C++ lambdas
+  // cuttlefish renders — no std::function, no heap allocation.
+  template <typename F>
+  SafeReadResult& ok(F&& handler) noexcept {
+    if (status == SafetyStatus::Ok) { handler(*this); }
+    return *this;
+  }
+  template <typename F>
+  SafeReadResult& fail(F&& handler) noexcept {
+    if (status != SafetyStatus::Ok) { handler(*this); }
+    return *this;
+  }
+  // fault is an alias of fail (no std::forward — avoids the <utility> header
+  // AVR lacks; the handler is called once immediately, so perfect forwarding
+  // is not load-bearing).
+  template <typename F>
+  SafeReadResult& fault(F&& handler) noexcept { return fail(handler); }
+  template <typename F>
+  SafeReadResult& always(F&& handler) noexcept { handler(*this); return *this; }
+};
+
+struct SafeWriteResult {
+  SafetyStatus status;
+  SafetyFaultCode code;
+
+  template <typename F>
+  SafeWriteResult& ok(F&& handler) noexcept {
+    if (status == SafetyStatus::Ok) { handler(*this); }
+    return *this;
+  }
+  template <typename F>
+  SafeWriteResult& fail(F&& handler) noexcept {
+    if (status != SafetyStatus::Ok) { handler(*this); }
+    return *this;
+  }
+  template <typename F>
+  SafeWriteResult& fault(F&& handler) noexcept { return fail(handler); }
+  template <typename F>
+  SafeWriteResult& always(F&& handler) noexcept { handler(*this); return *this; }
+};
+`.trim();
+}

package/dist/safety/runtime/safe-int.d.ts

@@ -0,0 +1,33 @@
+import type { RuntimePolyfillIR } from "../../api/index.js";
+/** SafeInt<T> polyfill: chainable bounds-checked signed-integer arithmetic.
+ *
+ *  Mutating chain — every math op returns SafeInt<T>& so calls compose:
+ *    x.add(5).mul(2).get()
+ *
+ *  Sticky-fault overflow policy: on overflow or division error, set fault_
+ *  and stop computing. Subsequent ops are no-ops returning *this. get()
+ *  returns the last good value. hasFault()/valid() inspect the flag;
+ *  reset() clears it.
+ *
+ *  Overflow detection uses portable pure-C++14 PRE-CHECKS (bounds tests
+ *  before the assignment). The reconstruction trick would compute first
+ *  then check, but the initial computation is signed-overflow UB. Pre-checks
+ *  avoid the UB, work at every width including int64_t (no wider promotion
+ *  type needed), and need no __builtin_*_overflow (a GCC/clang extension
+ *  that would require an AUTOSAR deviation).
+ *
+ *  NO <type_traits> / <limits> includes: AVR's toolchain ships neither
+ *  header. The type constraint (static_assert) and the per-width bounds come
+ *  from the shared hand-rolled __tc_safe_traits block (safe-traits.ts), which
+ *  uses only core-language features (template specialization, static_cast,
+ *  constexpr) that every supported target — including AVR's avr-gcc — has.
+ *
+ *  AUTOSAR C++14 compliance:
+ *  - static_assert on T (rejects unsigned, bool, float, non-integer)
+ *  - noexcept on all methods (A15-0-2)
+ *  - [[nodiscard]] on get/hasFault/valid (A0-1-1)
+ *  - constexpr constructor
+ *  - static_cast throughout (no C-casts M5-0-7, no builtins M5-0-10,
+ *    no malloc A18-5-10). Zero deviations required.
+ */
+export declare function safeIntPolyfill(): RuntimePolyfillIR;

package/dist/safety/runtime/safe-int.js

@@ -0,0 +1,170 @@
+import { emitSafeTraits } from "./safe-traits.js";
+/** SafeInt<T> polyfill: chainable bounds-checked signed-integer arithmetic.
+ *
+ *  Mutating chain — every math op returns SafeInt<T>& so calls compose:
+ *    x.add(5).mul(2).get()
+ *
+ *  Sticky-fault overflow policy: on overflow or division error, set fault_
+ *  and stop computing. Subsequent ops are no-ops returning *this. get()
+ *  returns the last good value. hasFault()/valid() inspect the flag;
+ *  reset() clears it.
+ *
+ *  Overflow detection uses portable pure-C++14 PRE-CHECKS (bounds tests
+ *  before the assignment). The reconstruction trick would compute first
+ *  then check, but the initial computation is signed-overflow UB. Pre-checks
+ *  avoid the UB, work at every width including int64_t (no wider promotion
+ *  type needed), and need no __builtin_*_overflow (a GCC/clang extension
+ *  that would require an AUTOSAR deviation).
+ *
+ *  NO <type_traits> / <limits> includes: AVR's toolchain ships neither
+ *  header. The type constraint (static_assert) and the per-width bounds come
+ *  from the shared hand-rolled __tc_safe_traits block (safe-traits.ts), which
+ *  uses only core-language features (template specialization, static_cast,
+ *  constexpr) that every supported target — including AVR's avr-gcc — has.
+ *
+ *  AUTOSAR C++14 compliance:
+ *  - static_assert on T (rejects unsigned, bool, float, non-integer)
+ *  - noexcept on all methods (A15-0-2)
+ *  - [[nodiscard]] on get/hasFault/valid (A0-1-1)
+ *  - constexpr constructor
+ *  - static_cast throughout (no C-casts M5-0-7, no builtins M5-0-10,
+ *    no malloc A18-5-10). Zero deviations required.
+ */
+export function safeIntPolyfill() {
+    return {
+        kind: "polyfill",
+        id: "safety_safe_int",
+        domain: "embedded",
+        requiredIncludes: [],
+        forwardDeclarations: [],
+        helperStructs: [],
+        helperFunctions: [`
+${emitSafeTraits()}
+
+#ifndef __TC_SAFE_INT_DEFINED
+#define __TC_SAFE_INT_DEFINED
+
+// No #include here: the fixed-width integer types come transitively from
+// <Arduino.h> on embedded targets (which pulls <stdint.h>), mirroring the
+// other safety polyfills (mode-table, vote). The shared __tc_safe_traits
+// block (emitted above) is also header-free.
+
+template <typename T>
+struct SafeInt {
+  static_assert(__tc_safe_traits::is_integral<T>::value
+                && __tc_safe_traits::is_signed<T>::value
+                && !__tc_safe_traits::is_same<T, bool>::value,
+                "SafeInt<T> requires a signed integer T (int8_t/int16_t/int32_t/int64_t). "
+                "Unsigned, bool, floating-point, and non-integer types are rejected.");
+
+private:
+  T value_;
+  bool fault_;
+
+  static constexpr T kMax = __tc_safe_traits::bounds<T>::kMax;
+  static constexpr T kMin = __tc_safe_traits::bounds<T>::kMin;
+
+public:
+  // Default constructor: zero-initialized, no fault. Required because promoted
+  // top-level variables default-construct via '= {}' before their real
+  // initializer is assigned inside the entrypoint. Mirrors SafeVariable's
+  // default ctor.
+  constexpr SafeInt() noexcept : value_(0), fault_(false) {}
+  constexpr SafeInt(T initial) noexcept : value_(initial), fault_(false) {}
+
+  SafeInt<T>& add(T delta) noexcept {
+    if (fault_) { return *this; }
+    // Pre-check: overflow iff (delta>0 && value>Max-delta) || (delta<0 && value<Min-delta).
+    // (Max-delta) and (Min-delta) are safe because delta has the opposite sign
+    // of the bound being approached, so the subtraction cannot itself overflow.
+    if ((delta > 0 && value_ > kMax - delta) || (delta < 0 && value_ < kMin - delta)) {
+      fault_ = true;
+      return *this;
+    }
+    value_ = static_cast<T>(value_ + delta);
+    return *this;
+  }
+
+  SafeInt<T>& sub(T delta) noexcept {
+    if (fault_) { return *this; }
+    // Direct pre-check (NOT add(-delta), since -delta is UB when delta==Min):
+    //   value - delta > Max  iff  value > Max + delta   (when delta < 0)
+    //   value - delta < Min  iff  value < Min + delta   (when delta > 0)
+    // (Max+delta)/(Min+delta) are safe — delta has the opposite sign of the bound.
+    if ((delta < 0 && value_ > kMax + delta) || (delta > 0 && value_ < kMin + delta)) {
+      fault_ = true;
+      return *this;
+    }
+    value_ = static_cast<T>(value_ - delta);
+    return *this;
+  }
+
+  SafeInt<T>& mul(T factor) noexcept {
+    if (fault_) { return *this; }
+    if (factor == 0 || value_ == 0) { value_ = 0; return *this; }
+    // Pre-check via absolute bounds. |value| > Max / |factor|  => overflow.
+    // (Also catches the value==Min && factor==-1 case since |Min| > Max.)
+    // absWithoutUB: -(kMin) is UB, so compute |kMin| as -(kMin+1) + (-1) = kMax... no,
+    // |kMin| is kMax+1 which is NOT representable. The check absValue > kMax/absFactor
+    // still fires for value==kMin because absValue (computed without UB) exceeds any
+    // representable positive value when factor==-1. We compute |x| without UB below.
+    const T absValue = (value_ < 0) ? static_cast<T>(-(value_ + 1)) + (-1) : value_;
+    const T absFactor = (factor < 0) ? static_cast<T>(-(factor + 1)) + (-1) : factor;
+    if (absValue > kMax / absFactor) {
+      fault_ = true;
+      return *this;
+    }
+    value_ = static_cast<T>(value_ * factor);
+    return *this;
+  }
+
+  // Named divide (not div) to avoid the cuttlefish reserved-name escaper
+  // renaming .div( to .div_( because div() is a C stdlib (<cstdlib>) name.
+  SafeInt<T>& divide(T d) noexcept {
+    if (fault_) { return *this; }
+    if (d == 0) { fault_ = true; return *this; }
+    // INT_MIN / -1 overflows.
+    if (value_ == kMin && d == static_cast<T>(-1)) { fault_ = true; return *this; }
+    value_ = static_cast<T>(value_ / d);
+    return *this;
+  }
+
+  SafeInt<T>& mod(T d) noexcept {
+    if (fault_) { return *this; }
+    if (d == 0) { fault_ = true; return *this; }
+    if (value_ == kMin && d == static_cast<T>(-1)) { value_ = 0; return *this; }
+    value_ = static_cast<T>(value_ % d);
+    return *this;
+  }
+
+  SafeInt<T>& negate() noexcept {
+    if (fault_) { return *this; }
+    if (value_ == kMin) { fault_ = true; return *this; }
+    value_ = static_cast<T>(-value_);
+    return *this;
+  }
+
+  // Named absValue (not abs) to avoid colliding with Arduino's abs() macro
+  // (Arduino.h #defines abs(x)), which would mangle the method declaration on
+  // AVR. Same caution for any future method whose name matches an Arduino core
+  // macro (min/max/round/...).
+  SafeInt<T>& absValue() noexcept {
+    if (fault_) { return *this; }
+    if (value_ == kMin) { fault_ = true; return *this; }
+    if (value_ < 0) { value_ = static_cast<T>(-value_); }
+    return *this;
+  }
+
+  [[nodiscard]] constexpr T get() const noexcept { return value_; }
+  [[nodiscard]] bool hasFault() const noexcept { return fault_; }
+  [[nodiscard]] bool valid() const noexcept { return !fault_; }
+
+  void reset(T newValue) noexcept { value_ = newValue; fault_ = false; }
+};
+
+#endif // __TC_SAFE_INT_DEFINED
+`.trim()],
+        shimMacros: [],
+        dependencies: [],
+    };
+}

package/dist/safety/runtime/safe-traits.d.ts

@@ -0,0 +1,4 @@
+/** Returns the C++ source for the __tc_safe_traits block. Idempotent via the
+ *  __TC_SAFE_TRAITS_DEFINED guard, so emitting it from both the SafeInt and
+ *  SafeVariable polyfills is harmless (the second include is a no-op). */
+export declare function emitSafeTraits(): string;

package/dist/safety/runtime/safe-traits.js

@@ -0,0 +1,95 @@
+// Hand-rolled C++ type traits for the safety polyfills.
+//
+// AVR's avr-gcc ships neither <type_traits> nor <limits>. The SafeInt and
+// SafeVariable polyfills need is_integral / is_signed / is_same for their
+// static_asserts, but must not include <type_traits>. This helper returns a
+// self-contained C++14 block (no includes) that defines a __tc_safe_traits
+// namespace with exactly the traits the polyfills use.
+//
+// SPECIALIZATION DISCIPLINE (avoids redefinition errors):
+// On AVR, the fixed-width typedefs alias the built-ins: int8_t == signed char,
+// int16_t == short, int32_t == long (int is 16-bit on AVR). Specializing for
+// BOTH a typedef and its underlying built-in is a redefinition error. So:
+//   - is_integral / is_signed specialize the BUILT-IN types only (signed char,
+//     short, int, long, long long, unsigned variants, char, bool). A lookup
+//     via a typedef (is_integral<int32_t>) resolves to the built-in
+//     specialization automatically because the typedef names the same type.
+//   - bounds specializes the FIXED-WIDTH typedefs only (int8_t/int16_t/
+//     int32_t/int64_t). Each typedef maps to exactly one specialization, and
+//     the bounds values match the typedef's width (not the host 'int' width).
+/** Returns the C++ source for the __tc_safe_traits block. Idempotent via the
+ *  __TC_SAFE_TRAITS_DEFINED guard, so emitting it from both the SafeInt and
+ *  SafeVariable polyfills is harmless (the second include is a no-op). */
+export function emitSafeTraits() {
+    return `
+#ifndef __TC_SAFE_TRAITS_DEFINED
+#define __TC_SAFE_TRAITS_DEFINED
+
+// No #include here: the integer types come transitively from <Arduino.h> on
+// embedded targets (which pulls <stdint.h>) and from the test harness's own
+// includes on native. This mirrors the other safety polyfills (mode-table,
+// vote) which use uint32_t with no explicit include.
+
+namespace __tc_safe_traits {
+
+// is_integral<T>: specialized on canonical built-in integer types only.
+// Lookups via fixed-width typedefs (int8_t/int32_t/etc.) resolve to these
+// because each typedef names the same type as its underlying built-in.
+template <typename T> struct is_integral { static constexpr bool value = false; };
+template <> struct is_integral<bool>               { static constexpr bool value = true; };
+template <> struct is_integral<char>               { static constexpr bool value = true; };
+template <> struct is_integral<signed char>        { static constexpr bool value = true; };
+template <> struct is_integral<unsigned char>      { static constexpr bool value = true; };
+template <> struct is_integral<short>              { static constexpr bool value = true; };
+template <> struct is_integral<unsigned short>     { static constexpr bool value = true; };
+template <> struct is_integral<int>                { static constexpr bool value = true; };
+template <> struct is_integral<unsigned int>       { static constexpr bool value = true; };
+template <> struct is_integral<long>               { static constexpr bool value = true; };
+template <> struct is_integral<unsigned long>      { static constexpr bool value = true; };
+template <> struct is_integral<long long>          { static constexpr bool value = true; };
+template <> struct is_integral<unsigned long long> { static constexpr bool value = true; };
+
+// is_signed<T>: specialized on canonical signed built-in integer types only.
+template <typename T> struct is_signed { static constexpr bool value = false; };
+template <> struct is_signed<signed char> { static constexpr bool value = true; };
+template <> struct is_signed<short>       { static constexpr bool value = true; };
+template <> struct is_signed<int>         { static constexpr bool value = true; };
+template <> struct is_signed<long>        { static constexpr bool value = true; };
+template <> struct is_signed<long long>   { static constexpr bool value = true; };
+
+// is_same<T,U>: standard two-type trait.
+template <typename T, typename U> struct is_same { static constexpr bool value = false; };
+template <typename T> struct is_same<T, T> { static constexpr bool value = true; };
+
+// bounds<T>: per-fixed-width min/max via literals + static_cast (no <limits>).
+// Specialized on the FIXED-WIDTH typedefs only. Each typedef has a unique
+// specialization whose bounds match that typedef's width (independent of the
+// host 'int' width — critical because AVR's int is 16-bit while ESP32/native
+// is 32-bit). int64_t is guarded because some freestanding toolchains lack it.
+template <typename T> struct bounds;
+template <> struct bounds<int8_t> {
+  static constexpr int8_t kMin = static_cast<int8_t>(static_cast<uint8_t>(0x80u));
+  static constexpr int8_t kMax = static_cast<int8_t>(0x7Fu);
+};
+template <> struct bounds<int16_t> {
+  static constexpr int16_t kMin = static_cast<int16_t>(static_cast<uint16_t>(0x8000u));
+  static constexpr int16_t kMax = static_cast<int16_t>(0x7FFFu);
+};
+template <> struct bounds<int32_t> {
+  static constexpr int32_t kMin = static_cast<int32_t>(static_cast<uint32_t>(0x80000000u));
+  static constexpr int32_t kMax = static_cast<int32_t>(0x7FFFFFFFu);
+};
+#if defined(__INT64_TYPE__)
+template <> struct bounds<__INT64_TYPE__> {
+  // Use unsigned-long-long literals (standard 'ull' suffix) and cast — the
+  // 'ill' signed suffix is a GNU extension needing -fext-numeric-literals.
+  static constexpr __INT64_TYPE__ kMin = static_cast<__INT64_TYPE__>(static_cast<unsigned long long>(0x8000000000000000ull));
+  static constexpr __INT64_TYPE__ kMax = static_cast<__INT64_TYPE__>(static_cast<unsigned long long>(0x7FFFFFFFFFFFFFFFull));
+};
+#endif
+
+}  // namespace __tc_safe_traits
+
+#endif // __TC_SAFE_TRAITS_DEFINED
+`.trim();
+}

package/dist/safety/runtime/safe-variable.d.ts

@@ -0,0 +1,39 @@
+import type { RuntimePolyfillIR } from "../../api/index.js";
+/** SafeVariable polyfill: 3-replica TMR with per-replica inversion for
+ *  integral types, and plain 3-copy TMR for float/double.
+ *
+ *  Combines TMR (triple modular redundancy) with inverted-redundancy for
+ *  integral types: three replicas of the value, each stored alongside its
+ *  bitwise inverse. On read, each replica is individually validated (XOR
+ *  check), then the valid replicas are majority-voted. This gives both
+ *  detection AND correction:
+ *
+ *  - A single-bit SEU in any replica's value or inverse breaks that
+ *    replica's XOR invariant → the corrupted replica is excluded from
+ *    the vote, and the good replicas correct it.
+ *  - If two replicas agree (majority), the value is returned with
+ *    confidence. The corrupted replica is silently repaired on the next
+ *    set().
+ *  - For float/double, replicas are stored as plain copies (no inversion
+ *    possible), and majority vote still corrects single-replica corruption.
+ *
+ *  Fault signaling: hasFault() returns true iff the last get() found ZERO
+ *  valid replicas (triple corruption). Callers should check hasFault() after
+ *  get() on safety-critical paths. set() clears the fault flag.
+ *
+ *  Memory cost: 3× T (same as plain TMR). The inversion is per-replica and
+ *  does not add copies beyond the three TMR replicas.
+ *
+ *  Arithmetic T only — a static_assert rejects non-arithmetic types (notably
+ *  std::string) and bool (for which bitwise inversion is ill-defined) at
+ *  compile time. float and double have explicit specializations.
+ *
+ *  AUTOSAR C++14 compliance:
+ *  - noexcept on all methods (A15-0-2)
+ *  - [[nodiscard]] on get/valid/hasFault (A0-1-1)
+ *  - constexpr constructors/methods
+ *  - no malloc/new (A18-5-8/A18-5-10)
+ *  - no C-style casts (M5-0-7)
+ *  - fixed-width types via template parameter (A3-9-1)
+ */
+export declare function safeVariablePolyfill(): RuntimePolyfillIR;