@typecad/cuttlefish 1.0.0-alpha.13 → 1.0.0-alpha.15

package/dist/safety/runtime/safe-variable.js

@@ -0,0 +1,226 @@
+import { emitSafeTraits } from "./safe-traits.js";
+/** SafeVariable polyfill: 3-replica TMR with per-replica inversion for
+ *  integral types, and plain 3-copy TMR for float/double.
+ *
+ *  Combines TMR (triple modular redundancy) with inverted-redundancy for
+ *  integral types: three replicas of the value, each stored alongside its
+ *  bitwise inverse. On read, each replica is individually validated (XOR
+ *  check), then the valid replicas are majority-voted. This gives both
+ *  detection AND correction:
+ *
+ *  - A single-bit SEU in any replica's value or inverse breaks that
+ *    replica's XOR invariant → the corrupted replica is excluded from
+ *    the vote, and the good replicas correct it.
+ *  - If two replicas agree (majority), the value is returned with
+ *    confidence. The corrupted replica is silently repaired on the next
+ *    set().
+ *  - For float/double, replicas are stored as plain copies (no inversion
+ *    possible), and majority vote still corrects single-replica corruption.
+ *
+ *  Fault signaling: hasFault() returns true iff the last get() found ZERO
+ *  valid replicas (triple corruption). Callers should check hasFault() after
+ *  get() on safety-critical paths. set() clears the fault flag.
+ *
+ *  Memory cost: 3× T (same as plain TMR). The inversion is per-replica and
+ *  does not add copies beyond the three TMR replicas.
+ *
+ *  Arithmetic T only — a static_assert rejects non-arithmetic types (notably
+ *  std::string) and bool (for which bitwise inversion is ill-defined) at
+ *  compile time. float and double have explicit specializations.
+ *
+ *  AUTOSAR C++14 compliance:
+ *  - noexcept on all methods (A15-0-2)
+ *  - [[nodiscard]] on get/valid/hasFault (A0-1-1)
+ *  - constexpr constructors/methods
+ *  - no malloc/new (A18-5-8/A18-5-10)
+ *  - no C-style casts (M5-0-7)
+ *  - fixed-width types via template parameter (A3-9-1)
+ */
+export function safeVariablePolyfill() {
+    return {
+        kind: "polyfill",
+        id: "safety_safe_variable",
+        domain: "embedded",
+        requiredIncludes: [],
+        forwardDeclarations: [],
+        helperStructs: [],
+        helperFunctions: [`
+${emitSafeTraits()}
+
+#ifndef __TC_SAFE_VARIABLE_DEFINED
+#define __TC_SAFE_VARIABLE_DEFINED
+
+// ── SafeVariable: integer types (bitwise XOR validation per replica) ──
+// Each replica stores value + ~value. On read, each replica is validated
+// independently. Valid replicas are majority-voted; the corrupted one
+// (if any) is excluded. This provides both detection AND correction.
+template <typename T>
+struct SafeVariable {
+  // Arithmetic T only. bool is rejected explicitly because ~bool and ^bool
+  // undergo integer promotion and do not behave as a 1-bit inversion.
+  // float/double are handled by the explicit specializations below.
+  static_assert(__tc_safe_traits::is_integral<T>::value && !__tc_safe_traits::is_same<T, bool>::value,
+                "SafeVariable<T> requires an integral T (use float/double specializations for those; "
+                "std::string and bool are not supported)");
+
+private:
+  T replicaA_val;
+  T replicaA_inv;
+  T replicaB_val;
+  T replicaB_inv;
+  T replicaC_val;
+  T replicaC_inv;
+  // mutable: get() is logically const (it does not change the stored value)
+  // but caches the "last read saw triple corruption" fault flag so callers
+  // can inspect it via hasFault() after get().
+  mutable bool fault_;
+  template <typename U> friend struct SafeVariable;
+
+  static bool replicaValid(T val, T inv) noexcept {
+    return (val ^ inv) == static_cast<T>(~static_cast<T>(0));
+  }
+
+public:
+  SafeVariable() noexcept
+      : replicaA_val(0), replicaA_inv(static_cast<T>(~static_cast<T>(0))),
+        replicaB_val(0), replicaB_inv(static_cast<T>(~static_cast<T>(0))),
+        replicaC_val(0), replicaC_inv(static_cast<T>(~static_cast<T>(0))),
+        fault_(false) {}
+
+  SafeVariable(T initial) noexcept
+      : replicaA_val(initial), replicaA_inv(static_cast<T>(~initial)),
+        replicaB_val(initial), replicaB_inv(static_cast<T>(~initial)),
+        replicaC_val(initial), replicaC_inv(static_cast<T>(~initial)),
+        fault_(false) {}
+
+  template <typename U>
+  SafeVariable(const SafeVariable<U>& other) noexcept
+      : replicaA_val(static_cast<T>(other.replicaA_val)), replicaA_inv(static_cast<T>(other.replicaA_inv)),
+        replicaB_val(static_cast<T>(other.replicaB_val)), replicaB_inv(static_cast<T>(other.replicaB_inv)),
+        replicaC_val(static_cast<T>(other.replicaC_val)), replicaC_inv(static_cast<T>(other.replicaC_inv)),
+        fault_(other.fault_) {}
+
+  // Majority vote: returns the agreed-upon value from valid replicas.
+  // If a replica is corrupted (XOR check fails), it is excluded from
+  // the vote. If two or more valid replicas agree, return that value.
+  // If only one replica is valid, return it as a best-effort fallback.
+  // If NO replica is valid (triple corruption), returns replicaC_val as a
+  // last resort and sets the fault flag — callers must check hasFault().
+  [[nodiscard]] T get() const noexcept {
+    const bool aValid = replicaValid(replicaA_val, replicaA_inv);
+    const bool bValid = replicaValid(replicaB_val, replicaB_inv);
+    const bool cValid = replicaValid(replicaC_val, replicaC_inv);
+
+    // Two valid replicas agree → majority.
+    if (aValid && bValid && (replicaA_val == replicaB_val)) { fault_ = false; return replicaA_val; }
+    if (aValid && cValid && (replicaA_val == replicaC_val)) { fault_ = false; return replicaA_val; }
+    if (bValid && cValid && (replicaB_val == replicaC_val)) { fault_ = false; return replicaB_val; }
+
+    // Only one valid replica → return it (no majority but best available).
+    if (aValid) { fault_ = false; return replicaA_val; }
+    if (bValid) { fault_ = false; return replicaB_val; }
+    if (cValid) { fault_ = false; return replicaC_val; }
+
+    // Zero valid replicas → triple corruption. Flag the fault and return
+    // replicaC_val as a degenerate fallback; callers MUST check hasFault().
+    fault_ = true;
+    return replicaC_val;
+  }
+
+  // Returns true if all three replicas pass their XOR checks AND agree.
+  // Does not mutate the fault flag (it reflects the last get(), not valid()).
+  [[nodiscard]] bool valid() const noexcept {
+    return replicaValid(replicaA_val, replicaA_inv)
+        && replicaValid(replicaB_val, replicaB_inv)
+        && replicaValid(replicaC_val, replicaC_inv)
+        && (replicaA_val == replicaB_val)
+        && (replicaB_val == replicaC_val);
+  }
+
+  // Returns true iff the most recent get() found zero valid replicas
+  // (triple corruption). Cleared by set() and by a subsequent get() that
+  // finds at least one valid replica.
+  [[nodiscard]] bool hasFault() const noexcept { return fault_; }
+
+  void set(T newValue) noexcept {
+    const T inv = static_cast<T>(~newValue);
+    replicaA_val = newValue; replicaA_inv = inv;
+    replicaB_val = newValue; replicaB_inv = inv;
+    replicaC_val = newValue; replicaC_inv = inv;
+    fault_ = false;
+  }
+};
+
+// ── SafeVariable: float (3-replica majority vote, no inversion) ──
+// Floats can't use bitwise XOR/inversion. Three identical copies are
+// stored and majority-voted. A single corrupted copy is outvoted and
+// silently repaired on the next set().
+template <>
+struct SafeVariable<float> {
+private:
+  float replicaA;
+  float replicaB;
+  float replicaC;
+  mutable bool fault_;
+  template <typename U> friend struct SafeVariable;
+public:
+  SafeVariable() noexcept : replicaA(0.0f), replicaB(0.0f), replicaC(0.0f), fault_(false) {}
+  SafeVariable(float initial) noexcept : replicaA(initial), replicaB(initial), replicaC(initial), fault_(false) {}
+  [[nodiscard]] float get() const noexcept {
+    if (replicaA == replicaB) { fault_ = false; return replicaA; }
+    if (replicaA == replicaC) { fault_ = false; return replicaA; }
+    if (replicaB == replicaC) { fault_ = false; return replicaB; }
+    // No two replicas agree — triple corruption.
+    fault_ = true;
+    return replicaC;
+  }
+  [[nodiscard]] bool valid() const noexcept {
+    return (replicaA == replicaB) && (replicaB == replicaC);
+  }
+  [[nodiscard]] bool hasFault() const noexcept { return fault_; }
+  void set(float newValue) noexcept {
+    replicaA = newValue;
+    replicaB = newValue;
+    replicaC = newValue;
+    fault_ = false;
+  }
+};
+
+// ── SafeVariable: double (3-replica majority vote, no inversion) ──
+template <>
+struct SafeVariable<double> {
+private:
+  double replicaA;
+  double replicaB;
+  double replicaC;
+  mutable bool fault_;
+  template <typename U> friend struct SafeVariable;
+public:
+  SafeVariable() noexcept : replicaA(0.0), replicaB(0.0), replicaC(0.0), fault_(false) {}
+  SafeVariable(double initial) noexcept : replicaA(initial), replicaB(initial), replicaC(initial), fault_(false) {}
+  [[nodiscard]] double get() const noexcept {
+    if (replicaA == replicaB) { fault_ = false; return replicaA; }
+    if (replicaA == replicaC) { fault_ = false; return replicaA; }
+    if (replicaB == replicaC) { fault_ = false; return replicaB; }
+    // No two replicas agree — triple corruption.
+    fault_ = true;
+    return replicaC;
+  }
+  [[nodiscard]] bool valid() const noexcept {
+    return (replicaA == replicaB) && (replicaB == replicaC);
+  }
+  [[nodiscard]] bool hasFault() const noexcept { return fault_; }
+  void set(double newValue) noexcept {
+    replicaA = newValue;
+    replicaB = newValue;
+    replicaC = newValue;
+    fault_ = false;
+  }
+};
+
+#endif // __TC_SAFE_VARIABLE_DEFINED
+`.trim()],
+        shimMacros: [],
+        dependencies: [],
+    };
+}

package/dist/safety/runtime/vote.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimePolyfillIR } from "../../api/index.js";
+/** The 2-of-3 voter. Tree-shaken out unless __tc_safety_read_safe appears
+ *  in the program (registered in POLYFILL_HELPER_MAP).
+ *
+ *  MCU-agnosticism: the voter reads via the strategy-injected __tc_gpio_read
+ *  shim (defined per-target by each framework strategy's shimLines()). The
+ *  safety package references zero target-specific symbols. */
+export declare function voterPolyfill(): RuntimePolyfillIR;

package/dist/safety/runtime/vote.js

@@ -0,0 +1,92 @@
+/** The 2-of-3 voter. Tree-shaken out unless __tc_safety_read_safe appears
+ *  in the program (registered in POLYFILL_HELPER_MAP).
+ *
+ *  MCU-agnosticism: the voter reads via the strategy-injected __tc_gpio_read
+ *  shim (defined per-target by each framework strategy's shimLines()). The
+ *  safety package references zero target-specific symbols. */
+export function voterPolyfill() {
+    return {
+        kind: "polyfill",
+        id: "safety_read_safe",
+        domain: "embedded",
+        requiredIncludes: [],
+        forwardDeclarations: [],
+        helperStructs: [],
+        helperFunctions: [`
+// Forward declarations — the strategy's shimLines() defines these AFTER the
+// polyfill block (polyfills emit before shims in emitPreamble). Without the
+// forward decls, the voter's __tc_gpio_read / __tc_delay_us calls below would
+// be unresolved.
+int __tc_gpio_read(uint32_t pin);
+void __tc_delay_us(uint32_t us);
+
+namespace __tc_safety {
+
+// Settle delay between temporally-separated reads. ~2 us is enough to defeat
+// single-event transient (SET) glitches on a typical GPIO line while staying
+// well under a debounce timescale. Tunable in one place.
+constexpr uint32_t TC_SAFETY_SETTLE_US = 2U;
+
+// Perform 3 temporally-separated reads via the strategy-injected shim, take
+// the majority. On disagreement, VoteDisagreement. On pin-mode mismatch,
+// PinModeMismatch. On untracked pin, PinModeUnknown. value is left 0 when
+// ok==false — callers must check 'ok' before consuming 'value'.
+inline SafeReadResult read_safe(uint32_t pin) {
+  SafeReadResult result;
+  result.value    = 0x00000000U;
+  result.category = SafetyFaultCategory::Ok;
+  result.code     = SafetyFaultCode::Ok;
+  result.status   = SafetyStatus::Ok;
+
+  // 1. Confirm pin mode (Input, InputPullup, or InputPulldown are valid for
+  // reading). Output is rejected (PinModeMismatch). InputPulldown is
+  // accepted because it is a legitimate input mode on ESP32 (and AVR via
+  // external pulldown); rejecting it caused false faults.
+  const TrackedMode mode = get_pin_mode(pin);
+  if (mode == TrackedMode::Unknown) {
+    result.category = SafetyFaultCategory::Configuration;
+    result.code     = SafetyFaultCode::PinModeUnknown;
+    result.status   = SafetyStatus::Fault;
+    return result;
+  }
+  if ((mode != TrackedMode::Input) && (mode != TrackedMode::InputPullup) && (mode != TrackedMode::InputPulldown)) {
+    result.category = SafetyFaultCategory::Configuration;
+    result.code     = SafetyFaultCode::PinModeMismatch;
+    result.status   = SafetyStatus::Fault;
+    return result;
+  }
+
+  // 2. 2-of-3 vote via the strategy-injected __tc_gpio_read shim.
+  // __tc_delay_us provides temporal separation between reads so a single
+  // input glitch is unlikely to corrupt two samples; the strategy injects a
+  // real microsecond delay (Arduino/ESP32: delayMicroseconds; AVR:
+  // _native_delay_us; native: stub).
+  const uint32_t r0 = __tc_gpio_read(pin);
+  __tc_delay_us(TC_SAFETY_SETTLE_US);
+  const uint32_t r1 = __tc_gpio_read(pin);
+  __tc_delay_us(TC_SAFETY_SETTLE_US);
+  const uint32_t r2 = __tc_gpio_read(pin);
+
+  if ((r0 == r1) && (r1 == r2)) {
+    result.status = SafetyStatus::Ok;
+    result.value  = r0 ? 0xFFFFFFFFU : 0x00000000U;
+  } else {
+    result.category = SafetyFaultCategory::Signal;
+    result.code     = SafetyFaultCode::VoteDisagreement;
+    result.status   = SafetyStatus::Fault;
+  }
+  return result;
+}
+
+// Namespace-scoped forwarding entry point — kept inside the namespace so
+// the emitter's forward-declaration pass does not generate a global prototype
+// that references SafeReadResult before the struct is defined.
+inline SafeReadResult __tc_safety_read_safe(uint32_t pin) {
+  return read_safe(pin);
+}
+
+}  // namespace __tc_safety`.trim()],
+        shimMacros: [],
+        dependencies: ["safety_mode_table"],
+    };
+}

package/dist/safety/runtime/write-verify.d.ts

@@ -0,0 +1,8 @@
+import type { RuntimePolyfillIR } from "../../api/index.js";
+/** Write-then-readback verification. Tree-shaken out unless
+ *  __tc_safety_write_verify appears in the program (registered in
+ *  POLYFILL_HELPER_MAP).
+ *
+ *  MCU-agnosticism: writes via the strategy-injected __tc_gpio_write shim,
+ *  reads back via __tc_gpio_read — references zero target-specific symbols. */
+export declare function writeVerifyPolyfill(): RuntimePolyfillIR;

package/dist/safety/runtime/write-verify.js

@@ -0,0 +1,71 @@
+/** Write-then-readback verification. Tree-shaken out unless
+ *  __tc_safety_write_verify appears in the program (registered in
+ *  POLYFILL_HELPER_MAP).
+ *
+ *  MCU-agnosticism: writes via the strategy-injected __tc_gpio_write shim,
+ *  reads back via __tc_gpio_read — references zero target-specific symbols. */
+export function writeVerifyPolyfill() {
+    return {
+        kind: "polyfill",
+        id: "safety_write_verify",
+        domain: "embedded",
+        requiredIncludes: [],
+        forwardDeclarations: [],
+        helperStructs: [],
+        helperFunctions: [`
+// Forward declaration — the strategy's shimLines() defines this AFTER the
+// polyfill block (polyfills emit before shims in emitPreamble).
+void __tc_gpio_write(uint32_t pin, uint32_t value);
+int __tc_gpio_read(uint32_t pin);
+
+namespace __tc_safety {
+
+inline SafeWriteResult write_verify(uint32_t pin, uint32_t value) {
+  SafeWriteResult result;
+  result.code   = SafetyFaultCode::Ok;
+  result.status = SafetyStatus::Ok;
+
+  const TrackedMode mode = get_pin_mode(pin);
+  if (mode == TrackedMode::Unknown) {
+    result.code   = SafetyFaultCode::PinModeUnknown;
+    result.status = SafetyStatus::Fault;
+    return result;
+  }
+  if (mode != TrackedMode::Output) {
+    result.code   = SafetyFaultCode::PinModeMismatch;
+    result.status = SafetyStatus::Fault;
+    return result;
+  }
+
+  __tc_gpio_write(pin, (value != 0U) ? 0x1U : 0x0U);
+
+  // Read back the pin to verify the write took effect. On AVR/ESP32
+  // Arduino core, digitalRead on an OUTPUT pin returns the last value
+  // written to the PORT register, so this check catches software bugs
+  // (wrong pin, wrong mode) but not electrical faults (shorted pin,
+  // disconnected wire). True electrical verification requires external
+  // circuitry routing the output back to a separate input pin.
+  const int rd = __tc_gpio_read(pin);
+  const uint32_t readback = rd ? 0xFFFFFFFFU : 0x00000000U;
+  const uint32_t expected = (value != 0U) ? 0xFFFFFFFFU : 0x00000000U;
+
+  if (readback == expected) {
+    result.status = SafetyStatus::Ok;
+    result.code   = SafetyFaultCode::Ok;
+  } else {
+    result.status = SafetyStatus::Fault;
+    result.code   = SafetyFaultCode::WriteMismatch;
+  }
+  return result;
+}
+
+}  // namespace __tc_safety
+
+inline SafeWriteResult __tc_safety_write_verify(uint32_t pin, uint32_t value) {
+  return __tc_safety::write_verify(pin, value);
+}
+`.trim()],
+        shimMacros: [],
+        dependencies: ["safety_mode_table"],
+    };
+}

package/dist/safety/safe-int-types.d.ts

@@ -0,0 +1,45 @@
+/** SafeInt<T> — chainable bounds-checked signed-integer arithmetic.
+ *
+ *  The cuttlefish transpiler resolves SafeInt<number> to the C++ template
+ *  form SafeInt<int32_t> (and SafeInt<int8_t>/<int16_t>/<int64_t> for the
+ *  corresponding TS fixed-width aliases), and the safety polyfill provides
+ *  the template definition.
+ *
+ *  Signed integer T only. The emitted C++ template carries a static_assert
+ *  that rejects unsigned integers, bool, floating-point, and non-integer
+ *  types (notably string) at compile time.
+ *
+ *  Mutating chain: every math operation returns the same SafeInt<T> (by
+ *  reference) so calls chain: `x.add(5).mul(2).get()`. On overflow or
+ *  division error, a sticky fault flag is set and subsequent operations in
+ *  the chain become no-ops; get() returns the last good value. Check
+ *  hasFault() (or valid()) after a chain on safety-critical paths.
+ *
+ *  Usage:
+ *    let x: SafeInt<int32_t> = SafeInt(10);
+ *    x.add(5).mul(2);             // mutating chain — x is now 30
+ *    if (x.valid()) {
+ *      const v: int32_t = x.get();
+ *    }
+ */
+export interface SafeInt<T = number> {
+    add(delta: T): SafeInt<T>;
+    sub(delta: T): SafeInt<T>;
+    mul(factor: T): SafeInt<T>;
+    divide(d: T): SafeInt<T>;
+    mod(d: T): SafeInt<T>;
+    negate(): SafeInt<T>;
+    absValue(): SafeInt<T>;
+    get(): T;
+    /** True iff a prior operation in this chain overflowed or hit a division
+     *  error. Sticky — once set, stays set until reset(). While true, all
+     *  further math operations are no-ops and get() returns the last good
+     *  value. */
+    hasFault(): boolean;
+    /** !hasFault(). Symmetric with SafeVariable.valid(). */
+    valid(): boolean;
+    /** Clear the fault flag and set a new value. The only way to re-arm a
+     *  faulted SafeInt without reconstructing it. */
+    reset(newValue: T): void;
+}
+export declare function SafeInt<T>(initial: T): SafeInt<T>;

package/dist/safety/safe-int-types.js

@@ -0,0 +1,25 @@
+/** SafeInt<T> — chainable bounds-checked signed-integer arithmetic.
+ *
+ *  The cuttlefish transpiler resolves SafeInt<number> to the C++ template
+ *  form SafeInt<int32_t> (and SafeInt<int8_t>/<int16_t>/<int64_t> for the
+ *  corresponding TS fixed-width aliases), and the safety polyfill provides
+ *  the template definition.
+ *
+ *  Signed integer T only. The emitted C++ template carries a static_assert
+ *  that rejects unsigned integers, bool, floating-point, and non-integer
+ *  types (notably string) at compile time.
+ *
+ *  Mutating chain: every math operation returns the same SafeInt<T> (by
+ *  reference) so calls chain: `x.add(5).mul(2).get()`. On overflow or
+ *  division error, a sticky fault flag is set and subsequent operations in
+ *  the chain become no-ops; get() returns the last good value. Check
+ *  hasFault() (or valid()) after a chain on safety-critical paths.
+ *
+ *  Usage:
+ *    let x: SafeInt<int32_t> = SafeInt(10);
+ *    x.add(5).mul(2);             // mutating chain — x is now 30
+ *    if (x.valid()) {
+ *      const v: int32_t = x.get();
+ *    }
+ */
+export {};

package/dist/safety/safe-variable-types.d.ts

@@ -0,0 +1,29 @@
+/** SafeVariable<T> — SEU-resistant storage with inverted-redundancy.
+ *
+ *  The cuttlefish transpiler resolves SafeVariable<number> to the C++
+ *  template form SafeVariable<int> (or int32_t under --autosar), and the
+ *  safety polyfill provides the template definition.
+ *
+ *  Arithmetic T only. The emitted C++ template carries a static_assert that
+ *  rejects non-arithmetic types (notably string) and bool at compile time.
+ *  float/double have explicit specializations (3-copy plain TMR — bitwise
+ *  inversion is not defined for floating-point).
+ *
+ *  Usage:
+ *    let x: SafeVariable<number> = SafeVariable(0);
+ *    x.set(2000);
+ *    const current = x.get();      // best-effort value
+ *    if (x.hasFault()) { ... }     // triple corruption — get() is untrusted
+ *    if (x.valid()) { ... }        // all three replicas agree and pass XOR checks
+ */
+export interface SafeVariable<T = number> {
+    set(value: T): void;
+    get(): T;
+    valid(): boolean;
+    /** True iff the most recent get() found zero valid replicas (triple
+     *  corruption). Cleared by set() and by a subsequent get() that finds at
+     *  least one valid replica. Check this after get() on safety-critical
+     *  paths; a true return means the returned value is untrusted. */
+    hasFault(): boolean;
+}
+export declare function SafeVariable(initial: number): SafeVariable<any>;

package/dist/safety/safe-variable-types.js

@@ -0,0 +1,19 @@
+/** SafeVariable<T> — SEU-resistant storage with inverted-redundancy.
+ *
+ *  The cuttlefish transpiler resolves SafeVariable<number> to the C++
+ *  template form SafeVariable<int> (or int32_t under --autosar), and the
+ *  safety polyfill provides the template definition.
+ *
+ *  Arithmetic T only. The emitted C++ template carries a static_assert that
+ *  rejects non-arithmetic types (notably string) and bool at compile time.
+ *  float/double have explicit specializations (3-copy plain TMR — bitwise
+ *  inversion is not defined for floating-point).
+ *
+ *  Usage:
+ *    let x: SafeVariable<number> = SafeVariable(0);
+ *    x.set(2000);
+ *    const current = x.get();      // best-effort value
+ *    if (x.hasFault()) { ... }     // triple corruption — get() is untrusted
+ *    if (x.valid()) { ... }        // all three replicas agree and pass XOR checks
+ */
+export {};

package/dist/safety/safety-bridge.d.ts

@@ -1,11 +1,10 @@
-/** Dynamically load @typecad/safety/engine and register the hook.
- *  Called by transpile.ts at the start of each transpile run.
- *  Safe to call when @typecad/safety is absent (hook stays null). */
+/** Load the safety engine and register the hook. Called by transpile.ts at
+ *  the start of each transpile run. */
 export declare function loadSafetyEngine(): Promise<void>;
 /** Reset the safety bridge: forget a load was attempted and clear the hook.
  *  Mirrors resetUIEngine() so each transpile run / test starts clean. */
 export declare function resetSafetyEngine(): void;
-/** Test-only: force the bridge into the "no @typecad/safety" state — mark the
- *  load as already attempted and leave the hook null, exactly as if the
- *  dynamic import had failed because the package is not installed. */
+/** Test-only: force the bridge into the "safety not loaded" state — mark the
+ *  load as already attempted and leave the hook null, exactly as the old
+ *  dynamic import behaved when @typecad/safety was not installed. */
 export declare function __simulateSafetyAbsentForTest(): void;

package/dist/safety/safety-bridge.js

@@ -1,37 +1,24 @@
 // ---------------------------------------------------------------------------
-// Safety bridge — loads the safety engine from @typecad/safety and registers it.
+// Safety bridge — registers the built-in safety engine.
 //
-// transpile.ts calls loadSafetyEngine() at the start of transpileFile(). If
-// @typecad/safety is not installed, the import fails gracefully and the hook
-// stays null — cuttlefish works as a pure TS→C++ transpiler with no safety
-// support.
+// The engine used to ship as the optional @typecad/safety package and was
+// loaded via a dynamic package import; it now lives in this package under
+// src/safety/. transpile.ts still calls loadSafetyEngine() at the start of
+// transpileFile(), and the hook seam (safety-hook.ts) is unchanged so the
+// degradation paths (resetSafetyEngine / __simulateSafetyAbsentForTest) keep
+// working for tests.
 // ---------------------------------------------------------------------------
 import { setSafetyHook } from "../safety-hook.js";
 let loaded = false;
-/** Dynamically load @typecad/safety/engine and register the hook.
- *  Called by transpile.ts at the start of each transpile run.
- *  Safe to call when @typecad/safety is absent (hook stays null). */
+/** Load the safety engine and register the hook. Called by transpile.ts at
+ *  the start of each transpile run. */
 export async function loadSafetyEngine() {
     if (loaded)
         return;
     loaded = true;
-    try {
-        // Dynamic import — @typecad/safety is optional. The module specifier is
-        // routed through a variable (rather than a string literal) so tsc types
-        // the result as `any` and never resolves @typecad/safety's declaration
-        // files while type-checking this file. A literal specifier would make tsc
-        // load safety's dist/engine-index.d.ts, which imports back
-        // @typecad/cuttlefish/safety-hook-types — a self-referencing package path
-        // that resolves into this package's own dist/ output and causes TS5055
-        // ("would overwrite input file") on every rebuild where dist/ exists.
-        const safetyEnginePath = "@typecad/safety/engine";
-        const engine = await import(safetyEnginePath);
-        const hook = engine.registerSafetyEngine();
-        setSafetyHook(hook);
-    }
-    catch {
-        // @typecad/safety is not installed — cuttlefish works without safety.
-    }
+    const engine = await import("./engine.js");
+    const hook = engine.registerSafetyEngine();
+    setSafetyHook(hook);
 }
 /** Reset the safety bridge: forget a load was attempted and clear the hook.
  *  Mirrors resetUIEngine() so each transpile run / test starts clean. */
@@ -39,9 +26,9 @@ export function resetSafetyEngine() {
     loaded = false;
     setSafetyHook(null);
 }
-/** Test-only: force the bridge into the "no @typecad/safety" state — mark the
- *  load as already attempted and leave the hook null, exactly as if the
- *  dynamic import had failed because the package is not installed. */
+/** Test-only: force the bridge into the "safety not loaded" state — mark the
+ *  load as already attempted and leave the hook null, exactly as the old
+ *  dynamic import behaved when @typecad/safety was not installed. */
 export function __simulateSafetyAbsentForTest() {
     loaded = true;
     setSafetyHook(null);

package/dist/safety/sidecar-bridge.d.ts

@@ -1,5 +1,3 @@
 import type { SafetyMetadata } from "../safety-hook.js";
-/** Dynamically import the safety package's sidecar renderer.
- *  Uses a variable-held specifier so tsc doesn't try to resolve the
- *  @typecad/safety types at build time (avoids circular dependency). */
+/** Render the safety sidecar artifact via the built-in ISO 26262 writer. */
 export declare function renderSafetySidecar(metadata: SafetyMetadata, toolVersion: string): Promise<string>;

package/dist/safety/sidecar-bridge.js

@@ -1,22 +1,5 @@
-/** Dynamically import the safety package's sidecar renderer.
- *  Uses a variable-held specifier so tsc doesn't try to resolve the
- *  @typecad/safety types at build time (avoids circular dependency). */
+import { renderSafetySidecar as renderSidecar } from "./iso26262/sidecar-writer.js";
+/** Render the safety sidecar artifact via the built-in ISO 26262 writer. */
 export async function renderSafetySidecar(metadata, toolVersion) {
-    const spec = "@typecad/safety/iso26262/sidecar-writer";
-    try {
-        const mod = await import(spec);
-        return mod.renderSafetySidecar(metadata, toolVersion);
-    }
-    catch {
-        // Fallback: inline the renderer so the sidecar is produced even if
-        // the subpath export isn't configured.
-        return JSON.stringify({
-            schemaVersion: "1.0.0",
-            standard: "ISO 26262 Part 6",
-            tool: "cuttlefish (@typecad/safety)",
-            toolVersion,
-            generatedAt: new Date().toISOString(),
-            safetyFunctions: metadata.functions,
-        }, null, 2);
-    }
+    return renderSidecar(metadata, toolVersion);
 }

package/dist/safety/specifiers.d.ts

@@ -0,0 +1,6 @@
+/** The canonical specifier for the safety authoring surface. */
+export declare const SAFETY_SPECIFIER = "@typecad/cuttlefish/safety";
+/** The legacy specifier from when safety was a standalone package. */
+export declare const LEGACY_SAFETY_SPECIFIER = "@typecad/safety";
+/** True iff an import specifier refers to the safety authoring surface. */
+export declare function isSafetyImportSpecifier(moduleSpecifier: string): boolean;