tla-ts 0.0.1 → 0.0.2

package/dist/transfer.cjs

@@ -6,55 +6,404 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-var e=class extends Error{constructor(e,t){super(e,{cause:t}),this.name=`TlaError`}},t=class extends e{constructor(e,t){super(e,t),this.name=`TlaSyntaxError`}},n=class extends e{constructor(e,t){super(e,t),this.name=`TlaConfigError`}},r=class extends e{constructor(e,t){super(e,t),this.name=`TlaEvaluationError`}},i=class extends e{constructor(e,t){super(e,t),this.name=`TlaUnsupportedError`}};const a=/* @__PURE__ */ new Set(/* @__PURE__ */ `ASSUME.ASSUMPTION.AXIOM.CASE.CHOOSE.CONSTANT.CONSTANTS.COROLLARY.DOMAIN.ELSE.ENABLED.EXCEPT.EXTENDS.IF.IN.INSTANCE.LAMBDA.LEMMA.LET.LOCAL.MODULE.OTHER.PROOF.PROPOSITION.RECURSIVE.SUBSET.THEN.THEOREM.UNCHANGED.UNION.VARIABLE.VARIABLES.WITH`.split(`.`)),o=/* @__PURE__ */ new Map([[`in`,`\\in`],[`notin`,`\\notin`],[`subseteq`,`\\subseteq`],[`subset`,`\\subset`],[`supseteq`,`\\supseteq`],[`supset`,`\\supset`],[`cup`,`\\cup`],[`union`,`\\cup`],[`cap`,`\\cap`],[`intersect`,`\\cap`],[`X`,`\\X`],[`times`,`\\X`],[`o`,`\\o`],[`circ`,`\\o`],[`div`,`\\div`],[`land`,`/\\`],[`lor`,`\\/`],[`lnot`,`~`],[`neg`,`~`],[`equiv`,`<=>`],[`leq`,`<=`],[`geq`,`>=`],[`A`,`\\A`],[`forall`,`\\A`],[`E`,`\\E`],[`exists`,`\\E`],[`AA`,`\\AA`],[`EE`,`\\EE`],[`cdot`,`\\cdot`],[`sqsubseteq`,`\\sqsubseteq`],[`sqsupseteq`,`\\sqsupseteq`],[`sqsubset`,`\\sqsubset`],[`sqsupset`,`\\sqsupset`],[`sqcap`,`\\sqcap`],[`sqcup`,`\\sqcup`],[`oplus`,`\\oplus`],[`ominus`,`\\ominus`],[`otimes`,`\\otimes`],[`oslash`,`\\oslash`],[`odot`,`\\odot`],[`uplus`,`\\uplus`],[`prec`,`\\prec`],[`preceq`,`\\preceq`],[`succ`,`\\succ`],[`succeq`,`\\succeq`],[`sim`,`\\sim`],[`simeq`,`\\simeq`],[`approx`,`\\approx`],[`cong`,`\\cong`],[`asymp`,`\\asymp`],[`doteq`,`\\doteq`],[`propto`,`\\propto`],[`wr`,`\\wr`],[`star`,`\\star`],[`bullet`,`\\bullet`],[`bigcirc`,`\\bigcirc`],[`ll`,`\\ll`],[`gg`,`\\gg`]]),s=/* @__PURE__ */ new Map([[`/=`,`#`],[`=<`,`<=`],[`(+)`,`\\oplus`],[`(-)`,`\\ominus`],[`(.)`,`\\odot`],[`(/)`,`\\oslash`],[`(\\X)`,`\\otimes`]]),c=/* @__PURE__ */ `-+-> (\\X) <=> |-> ... ::= >>_ (+) (-) (.) (/) == => =< =| << <= <> <- >> >= /\\ \\/ /= [] ]_ |- |= || -> -| ~> .. :: := :> <: @@ ++ -- -. ** // ^^ ^+ ^* ^# %% ## && $$ ?? !! = < > / [ ] ( ) { } | - ~ . : @ , ' ! # % + * ^ & $ ?`.split(` `),l=/* @__PURE__ */ new Map([[`∧`,`/\\`],[`∨`,`\\/`],[`¬`,`~`],[`⇒`,`=>`],[`⟹`,`=>`],[`≡`,`<=>`],[`⇔`,`<=>`],[`∈`,`\\in`],[`∉`,`\\notin`],[`⊆`,`\\subseteq`],[`⊂`,`\\subset`],[`⊇`,`\\supseteq`],[`⊃`,`\\supset`],[`∪`,`\\cup`],[`∩`,`\\cap`],[`×`,`\\X`],[`∀`,`\\A`],[`∃`,`\\E`],[`≠`,`#`],[`≤`,`<=`],[`≥`,`>=`],[`↦`,`|->`],[`→`,`->`],[`⟨`,`<<`],[`⟩`,`>>`],[`□`,`[]`],[`◇`,`<>`],[`≜`,`==`],[`′`,`'`],[`∘`,`\\o`],[`⋅`,`\\cdot`]]),u=/^\\([bB][01]+|[oO][0-7]+|[hH][0-9a-fA-F]+)/,d=/* @__PURE__ */ new Map([[`b`,2],[`o`,8],[`h`,16]]),f=/-{4,}[ \t]*MODULE\b/,p=e=>/[A-Za-z0-9_]/.test(e),m=(e,t)=>{let n=e[t];if(n===`\\`&&/[A-Za-z]/.test(e[t+1]??``)){let n=/^[A-Za-z]+/.exec(e.slice(t+1))?.[0]??``,r=o.get(n);return r===void 0?void 0:{text:r,length:n.length+1}}let r=l.get(n);if(r)return{text:r,length:n.length};let i=c.find(n=>e.startsWith(n,t));return i?{text:s.get(i)??i,length:i.length}:n===`\\`?{text:`\\`,length:1}:void 0},h=(e,t)=>t===`	`?e+8-e%8:e+1,g=e=>{let n=f.exec(e);if(!n)throw new t(`Expected a module header such as ---- MODULE Name ----`);let r=[],i=e.slice(0,n.index).split(`
-`),o={index:n.index,line:i.length,lineStart:n.index-i[i.length-1].length,moduleDepth:0},s={lineStart:-1,position:0,width:0},c=()=>{for((s.lineStart!==o.lineStart||s.position>o.index)&&(s.lineStart=o.lineStart,s.position=o.lineStart,s.width=0);s.position<o.index;s.position++)s.width=h(s.width,e[s.position]);return h(s.width,e[o.index])},l=(e,t,n)=>{r.push({kind:e,text:t,line:o.line,column:c()}),o.index+=n},g=t=>{for(let n=0;n<t;n++)e[o.index]===`
-`&&(o.line++,o.lineStart=o.index+1),o.index++},_=e=>new t(`${e} at line ${o.line}, column ${c()}`);for(;o.index<e.length;){let t=e[o.index],n=e.slice(o.index,o.index+8);if(t===`
-`||t===` `||t===`	`||t===`\r`){g(1);continue}if(n.startsWith(`\\*`)){let t=e.indexOf(`
-`,o.index);g((t===-1?e.length:t)-o.index);continue}if(n.startsWith(`(*`)){let t={value:0};do{if(o.index>=e.length)throw _(`Unterminated comment`);e.startsWith(`(*`,o.index)?(t.value++,g(2)):e.startsWith(`*)`,o.index)?(t.value--,g(2)):g(1)}while(t.value>0);continue}if(n.startsWith(`----`)){let t=/^-+/.exec(e.slice(o.index))?.[0].length??0;e.slice(o.index+t).trimStart().startsWith(`MODULE`)&&o.moduleDepth++,l(`Separator`,`----`,t);continue}if(n.startsWith(`====`)){if(l(`ModuleEnd`,`====`,/^=+/.exec(e.slice(o.index))?.[0].length??0),o.moduleDepth--,o.moduleDepth>0)continue;let t=f.exec(e.slice(o.index));if(!t)break;g(t.index);continue}if(t===`"`){let t=o.line,n=c(),i=[];for(g(1);e[o.index]!==`"`;){if(o.index>=e.length||e[o.index]===`
-`)throw _(`Unterminated string`);if(e[o.index]===`\\`){let t=e[o.index+1],n={n:`
-`,t:`	`,r:`\r`,f:`\f`}[t]??t;i.push(n),g(2)}else i.push(e[o.index]),g(1)}g(1),r.push({kind:`String`,text:i.join(``),line:t,column:n});continue}let i=u.exec(e.slice(o.index,o.index+64));if(i){let e=d.get(i[1][0].toLowerCase());l(`Number`,String(parseInt(i[1].slice(1),e)),i[0].length);continue}if(p(t)){let t=/^[A-Za-z0-9_]+/.exec(e.slice(o.index))?.[0]??``;if(/^\d+$/.test(t)){l(`Number`,t,t.length);continue}if(t.startsWith(`WF_`)||t.startsWith(`SF_`)){l(`Keyword`,t.slice(0,3),3);continue}l(a.has(t)?`Keyword`:`Identifier`,t,t.length);continue}let s=m(e,o.index);if(s)l(`Operator`,s.text,s.length);else throw _(t===`\\`?`Unknown operator \\${/^[A-Za-z]+/.exec(e.slice(o.index+1))?.[0]??``}`:`Unexpected character ${JSON.stringify(t)}`)}return r.push({kind:`End`,text:``,line:o.line,column:c()}),r},_=/* @__PURE__ */ new Set([`CONSTANT`,`CONSTANTS`,`INIT`,`NEXT`,`SPECIFICATION`,`INVARIANT`,`INVARIANTS`,`PROPERTY`,`PROPERTIES`,`CONSTRAINT`,`CONSTRAINTS`,`ACTION_CONSTRAINT`,`ACTION_CONSTRAINTS`,`SYMMETRY`,`VIEW`,`CHECK_DEADLOCK`,`ALIAS`,`POSTCONDITION`,`POSTCONDITIONS`,`_POSSIBLE`]),v=[`<-`,`<<`,`>>`,`=`,`{`,`}`,`,`,`[`,`]`,`(`,`)`],y=e=>{let t=[],r={index:0,line:1};for(;r.index<e.length;){let i=e.slice(r.index),a=/^\s+/.exec(i)?.[0];if(a){r.line+=a.split(`
-`).length-1,r.index+=a.length;continue}if(i.startsWith(`\\*`)){let e=i.indexOf(`
-`);r.index+=e===-1?i.length:e;continue}if(i.startsWith(`(*`)){let e=i.indexOf(`*)`);if(e===-1)throw new n(`Unterminated comment at line ${r.line}`);r.line+=i.slice(0,e).split(`
-`).length-1,r.index+=e+2;continue}let o=/^-?\d+(?![A-Za-z_])/.exec(i)?.[0];if(o){t.push({kind:`Number`,text:o,line:r.line}),r.index+=o.length;continue}let s=/^[A-Za-z0-9_!]+/.exec(i)?.[0];if(s){t.push({kind:`Word`,text:s,line:r.line}),r.index+=s.length;continue}let c=/^"((?:[^"\\]|\\.)*)"/.exec(i);if(c){t.push({kind:`String`,text:JSON.parse(`"${c[1]}"`),line:r.line}),r.index+=c[0].length;continue}let l=v.find(e=>i.startsWith(e));if(l){t.push({kind:`Symbol`,text:l,line:r.line}),r.index+=l.length;continue}let u=m(e,r.index);if(!u)throw new n(`Unexpected character ${JSON.stringify(i[0])} at line ${r.line}`);t.push({kind:`Word`,text:u.text,line:r.line}),r.index+=u.length}return t.push({kind:`End`,text:``,line:r.line}),t},ee=e=>{let t=y(e),r={index:0},i={init:void 0,next:void 0,specification:void 0,invariants:[],properties:[],constraints:[],actionConstraints:[],constants:[],substitutions:[],checkDeadlock:!0,symmetry:void 0,view:void 0,postconditions:[],possible:[]},a=()=>t[r.index],o=()=>t[r.index++],s=e=>e.kind===`Word`&&_.has(e.text),c=e=>{let t=o();if(t.text!==e)throw new n(`Expected ${JSON.stringify(e)} but found ${JSON.stringify(t.text)} at line ${t.line}`)},l=()=>{let e=o();if(e.kind!==`Word`||s(e))throw new n(`Expected a name but found ${JSON.stringify(e.text)} at line ${e.line}`);return e.text},u=()=>{let e=[];for(;a().kind===`Word`&&!s(a());)e.push(o().text);return e},d=(e,t)=>{if(i[e]!==void 0)throw new n(`The keyword ${t} appears twice`);i[e]=l()},f=()=>{let e=o();if(e.kind===`Number`)return{kind:`Number`,value:Number(e.text)};if(e.kind===`String`)return{kind:`String`,value:e.text};if(e.text===`TRUE`||e.text===`FALSE`)return{kind:`Boolean`,value:e.text===`TRUE`};if(e.text===`{`){let e=[];for(;a().text!==`}`;)e.push(f()),a().text!==`}`&&c(`,`);return o(),{kind:`Set`,elements:e}}if(e.kind===`Word`&&!s(e))return{kind:`ModelValue`,name:e.text};throw new n(`Expected a value but found ${JSON.stringify(e.text)} at line ${e.line}`)},p=()=>{if(a().text!==`[`)return;o();let e=l();return c(`]`),e},m=()=>{for(;a().kind===`Word`&&!s(a());){let e=o().text;if(a().text===`(`){o();let t=[];for(;a().text!==`)`;)t.push(f()),a().text!==`)`&&c(`,`);o(),c(`=`),i.constants.push({name:e,value:f(),args:t});continue}if(a().text===`<-`){o();let t=p();i.substitutions.push({name:e,target:l(),...t&&{module:t}});continue}c(`=`);let t=p();i.constants.push({name:e,value:f(),...t&&{module:t}})}};for(;a().kind!==`End`;){let e=o();switch(e.text){case`CONSTANT`:case`CONSTANTS`:m();break;case`INIT`:d(`init`,e.text);break;case`NEXT`:d(`next`,e.text);break;case`SPECIFICATION`:d(`specification`,e.text);break;case`SYMMETRY`:d(`symmetry`,e.text);break;case`VIEW`:d(`view`,e.text);break;case`INVARIANT`:case`INVARIANTS`:i.invariants.push(...u());break;case`PROPERTY`:case`PROPERTIES`:i.properties.push(...u());break;case`CONSTRAINT`:case`CONSTRAINTS`:i.constraints.push(...u());break;case`ACTION_CONSTRAINT`:case`ACTION_CONSTRAINTS`:i.actionConstraints.push(...u());break;case`ALIAS`:l();break;case`POSTCONDITION`:case`POSTCONDITIONS`:i.postconditions.push(...u());break;case`_POSSIBLE`:i.possible.push(...u());break;case`CHECK_DEADLOCK`:{let e=o().text;if(e!==`TRUE`&&e!==`FALSE`)throw new n(`CHECK_DEADLOCK expects TRUE or FALSE but found ${JSON.stringify(e)}`);i.checkDeadlock=e===`TRUE`;break}default:throw new n(`Unexpected ${JSON.stringify(e.text)} at line ${e.line}`)}}if(i.specification!==void 0&&(i.init!==void 0||i.next!==void 0))throw new n(`SPECIFICATION cannot be combined with INIT or NEXT`);return i},b=2147483647,x=e=>typeof e==`object`&&e.kind!==`ModelValue`&&e.kind!==`Function`&&e.kind!==`LazyFunction`,S=e=>typeof e==`object`&&(e.kind===`Function`||e.kind===`LazyFunction`),C=e=>typeof e==`object`&&e.kind===`ModelValue`,w=e=>typeof e==`boolean`?`boolean`:typeof e==`number`?`integer`:typeof e==`string`?`string`:e.kind===`ModelValue`?`model value`:x(e)?`set`:`function`,te=e=>{if(!Number.isInteger(e)||e>b||e<-2147483648)throw new r(`Integer overflow: ${e} is outside TLC's 32-bit range`);return e},ne=(e,t)=>{let n=e.domain,r=t.domain;if(n.length!==r.length)return n.length-r.length;if(n!==r)for(let e=0;e<n.length;e++){let t=T(n[e],r[e]);if(t!==0)return t}let i=e.range,a=t.range;if(i===a)return 0;for(let e=0;e<i.length;e++){let t=T(i[e],a[e]);if(t!==0)return t}return 0},re=(e,t)=>{let n=e.elements,r=t.elements;if(n.length!==r.length)return n.length-r.length;if(n===r)return 0;for(let e=0;e<n.length;e++){let t=T(n[e],r[e]);if(t!==0)return t}return 0},ie=e=>C(e)&&e.name.length>2&&e.name[1]===`_`?e.name[0]:void 0,ae=(e,t,n)=>{let i=ie(e),a=ie(t);if(i===void 0&&a===void 0)return;let o=n?`check equality of`:`compare`;if(C(e)&&C(t)){if(i===void 0||a===void 0||i===a)return;throw new r(`Attempted to ${o} the differently-typed model values ${I(e)} and ${I(t)}`)}throw i===void 0?new r(`Attempted to ${o} the typed model value ${I(t)} and the non-model value\n${I(e)}`):new r(`Attempted to ${o}${n?``:` the`} typed model value ${I(e)} and non-model value\n${I(t)}`)},T=(e,t)=>{if(e===t)return 0;if(typeof e==`object`&&typeof t==`object`){let n=e.kind,i=t.kind;if(n===`Function`&&i===`Function`)return ne(e,t);if(n===`Set`&&i===`Set`)return re(e,t);if(n===`ModelValue`||i===`ModelValue`)return ae(e,t,!1),n===`ModelValue`&&i===`ModelValue`?e.name<t.name?-1:+(e.name>t.name):n===`ModelValue`?-1:1;let a=e=>e.kind===`InfiniteSet`&&e.name===`Any`;if(a(e)||a(t))throw new r(`Attempted to compare ANY with ${I(a(e)?t:e)}`);if(n===`InfiniteSet`&&i===`InfiniteSet`){if(e.name===t.name)return 0;if(e.name!==`STRING`&&t.name!==`STRING`)return e.name===`Nat`?-1:1}let o=x(e);if(o!==x(t))throw new r(`Attempted to compare ${w(e)} ${I(e)} with ${w(t)} ${I(t)}`);return o?re(N(e),N(t)):ne(F(e),F(t))}if(typeof e==`number`&&typeof t==`number`)return e-t;if(typeof e==`string`&&typeof t==`string`||typeof e==`boolean`&&typeof t==`boolean`)return e<t?-1:1;if(ae(e,t,!1),C(e))return-1;if(C(t))return 1;throw new r(`Attempted to compare ${w(e)} ${I(e)} with ${w(t)} ${I(t)}`)},E=/* @__PURE__ */ new Map,oe=e=>{let t=E.get(e);if(t)return t;let n={kind:`ModelValue`,name:e};return E.set(e,n),n},D=e=>({kind:`Set`,elements:e,hash:0,fingerprint:0}),O=(e,t)=>({kind:`Function`,domain:e,range:t,hash:0,fingerprint:0}),k=(e,t)=>e===t?!0:typeof e!=`object`||typeof t!=`object`?typeof e!=typeof t&&((typeof e==`object`||typeof t==`object`)&&ae(e,t,!0),T(e,t)===0):(e.kind===`Set`||e.kind===`Function`)&&(t.kind===`Set`||t.kind===`Function`)&&e.hash!==0&&t.hash!==0&&e.hash!==t.hash?!1:e.kind===`Function`&&t.kind===`Function`?ne(e,t)===0:e.kind===`Set`&&t.kind===`Set`?re(e,t)===0:C(e)||C(t)?(ae(e,t,!0),C(e)&&C(t)&&e.name===t.name):x(e)&&x(t)&&!(M(e)&&M(t))?Ke(e)===Ke(t):T(e,t)===0,se=(e,t)=>e===t||e.length===t.length&&e.every((e,n)=>ce(e,t[n])),ce=(e,t)=>e===t?!0:typeof e!=`object`||typeof t!=`object`?!1:e.kind===`Set`&&t.kind===`Set`?(e.hash===0||t.hash===0||e.hash===t.hash)&&se(e.elements,t.elements):e.kind===`Function`&&t.kind===`Function`?(e.hash===0||t.hash===0||e.hash===t.hash)&&se(e.domain,t.domain)&&se(e.range,t.range):Ke(e)===Ke(t),le=e=>{for(let t=1;t<e.length;t++)if(T(e[t-1],e[t])>=0)return!1;return!0},A=e=>{if(e.length<2||le(e))return D(e);let t=[...e].sort(T),n=[t[0]];for(let e=1;e<t.length;e++)T(n[n.length-1],t[e])!==0&&n.push(t[e]);return D(n)},ue=(e,t)=>{if(e.elements.length===0||t.elements.length===0)return e;let n=e.elements,r=t.elements,i=[],a=0;for(let e=0;e<n.length;e++){let t=n[e];for(;a<r.length&&T(r[a],t)<0;)a++;a<r.length&&T(r[a],t)===0||i.push(t)}return i.length===n.length?e:D(i)},de=(e,t)=>{let n=e.elements,r=t.elements,i=[],a=0;for(let e=0;e<n.length;e++){let t=n[e];for(;a<r.length&&T(r[a],t)<0;)a++;a<r.length&&T(r[a],t)===0&&i.push(t)}return i.length===n.length?e:D(i)},fe=(e,t)=>{if(e.elements.length===0)return t;if(t.elements.length===0)return e;let n=e.elements,r=t.elements,i=[],a=[],o=0,s=0;for(;o<n.length&&s<r.length;){let e=T(n[o],r[s]);e<0?i.push(n[o++]):e>0?(a.push(r[s]),i.push(r[s++])):(i.push(n[o++]),s++)}for(;o<n.length;)i.push(n[o++]);for(;s<r.length;)a.push(r[s]),i.push(r[s++]);if(a.length===0)return e;let c=D(i);if(e.hash!==0){let t=e.hash;for(let e=0;e<a.length;e++)t=t+Pe(a[e])|0;c.hash=t}if(e.fingerprint!==0){let t=e.fingerprint;for(let e=0;e<a.length;e++)t=t+Ve(a[e])|0;c.fingerprint=t}return c},pe=e=>{let t=e.length<2?e:[...e].sort((e,t)=>T(e[0],t[0])),n=[],r=[];for(let e of t)n.length>0&&T(n[n.length-1],e[0])===0||(n.push(e[0]),r.push(e[1]));return O(n,r)},j=e=>O(e.map((e,t)=>t+1),e),me=e=>pe(e),M=e=>{if(typeof e!=`object`)return!1;switch(e.kind){case`Set`:case`Interval`:return!0;case`InfiniteSet`:case`SequenceSet`:return!1;case`Subset`:case`FilteredSet`:return M(e.base);case`FunctionSet`:return M(e.domain)&&M(e.range);case`RecordSet`:return e.sets.every(M);case`ProductSet`:return e.factors.every(M);case`SetOperation`:return e.operator===`\\cup`?M(e.left)&&M(e.right):e.operator===`\\cap`?M(e.left)||M(e.right):M(e.left);default:return!1}},he=e=>{let t=e.reduce((e,t)=>e*t.length,1),n=[],r=e.map(()=>0);for(let i=0;i<t;i++){n.push(e.map((e,t)=>e[r[t]]));for(let t=e.length-1;t>=0&&(r[t]++,!(r[t]<e[t].length));t--)r[t]=0}return n},ge=(e,t)=>{for(let n=e.length-1;n>=0;n--)if(e[n]<t-e.length+n){e[n]++;for(let t=n+1;t<e.length;t++)e[t]=e[t-1]+1;return!0}return!1},_e=e=>{let t=[];for(let n=0;n<=e.length;n++){let r=Array.from({length:n},(e,t)=>t);do t.push(D(r.map(t=>e[t])));while(ge(r,e.length))}return t},ve=e=>{if(typeof e!=`object`)throw new r(`Expected a set but found ${I(e)}`);switch(e.kind){case`Set`:return e.elements;case`Interval`:return Array.from({length:Math.max(0,e.high-e.low+1)},(t,n)=>e.low+n);case`Subset`:{let t=N(e.base).elements;if(t.length>30)throw new r(`SUBSET of a set with ${t.length} elements is too large to enumerate`);return _e(t)}case`FunctionSet`:{let t=N(e.domain).elements,n=N(e.range).elements;return he(t.map(()=>n)).map(e=>O(t,e))}case`RecordSet`:return he(e.sets.map(e=>N(e).elements)).map(t=>me(e.names.map((e,n)=>[e,t[n]])));case`ProductSet`:return he(e.factors.map(e=>N(e).elements)).map(j);case`FilteredSet`:return N(e.base).elements.filter(e.test);case`SetOperation`:{if(!M(e))throw new r(`Attempted to enumerate the non-enumerable set ${I(e)}`);if(e.operator===`\\cup`)return fe(N(e.left),N(e.right)).elements;let t=e.operator===`\\`||M(e.left),n=t?e.left:e.right,i=t?e.right:e.left;return N(n).elements.filter(t=>P(t,i)===(e.operator===`\\cap`))}case`InfiniteSet`:case`SequenceSet`:throw new r(`Attempted to enumerate the non-enumerable set ${I(e)}`);default:throw new r(`Expected a set but found ${I(e)}`)}},ye=/* @__PURE__ */ new WeakMap,N=e=>{if(typeof e==`object`&&e.kind===`Set`)return e;let t=typeof e==`object`?ye.get(e):void 0;if(t)return t;let n=ve(e),r=typeof e==`object`&&(e.kind===`Interval`||e.kind===`SetOperation`||e.kind===`FilteredSet`||e.kind===`ProductSet`||e.kind===`FunctionSet`||e.kind===`Subset`)?D(n):A(n);return typeof e==`object`&&ye.set(e,r),r},be=(e,t)=>{if(e>b)throw new r(`Overflow when computing the number of elements in ${I(t)}`);return e},xe=e=>{if(typeof e!=`object`)return N(e).elements.length===0;switch(e.kind){case`Set`:return e.elements.length===0;case`Interval`:return e.low>e.high;case`InfiniteSet`:case`Subset`:case`SequenceSet`:return!1;case`ProductSet`:return e.factors.some(xe);case`RecordSet`:return e.sets.some(xe);case`FunctionSet`:return xe(e.range)&&!xe(e.domain);default:return N(e).elements.length===0}},Se=(e,t)=>e.some(xe)?0:e.map(Ce).reduce((e,n)=>be(e*n,t),1),Ce=e=>{if(typeof e!=`object`)return N(e).elements.length;switch(e.kind){case`Interval`:return Math.max(0,e.high-e.low+1);case`Subset`:return be(2**Ce(e.base),e);case`FunctionSet`:return xe(e)?0:Se(Array.from({length:Ce(e.domain)},()=>e.range),e);case`RecordSet`:return Se(e.sets,e);case`ProductSet`:return Se(e.factors,e);default:return N(e).elements.length}},we=(e,t)=>{let n={low:0,high:e.length-1};for(;n.low<=n.high;){let r=n.low+n.high>>1,i=T(e[r],t);if(i===0)return r;i<0?n.low=r+1:n.high=r-1}return-1},Te=e=>{if(typeof e!=`object`||!S(e))return;let t=F(e);return t.domain.every((e,t)=>e===t+1)?t.range:void 0},Ee=(e,t)=>`Attempted to check if the value ${I(e)} is an element of ${I(t)}`,P=(e,t)=>{if(typeof t!=`object`)throw new r(`Expected a set but found ${I(t)}`);switch(t.kind){case`Set`:return we(t.elements,e)!==-1;case`Interval`:if(typeof e==`number`)return e>=t.low&&e<=t.high;if(t.low<=t.high&&!C(e))throw new r(Ee(e,t));return!1;case`InfiniteSet`:if(t.name===`Any`)return!0;if(C(e))return!1;if(!(t.name===`STRING`?typeof e==`string`:typeof e==`number`))throw new r(Ee(e,t));return t.name!==`Nat`||typeof e==`number`&&e>=0;case`Subset`:if(!x(e))throw new r(Ee(e,t));return N(e).elements.every(e=>P(e,t.base));case`FunctionSet`:{if(!S(e)){if(C(e))return!1;throw new r(Ee(e,t))}let n=F(e);return k(D(n.domain),t.domain)&&n.range.every(e=>P(e,t.range))}case`RecordSet`:{if(!S(e)){if(C(e))return!1;throw new r(Ee(e,t))}let n=F(e);return n.domain.length===t.names.length&&t.names.every((e,r)=>{let i=we(n.domain,e);return i!==-1&&P(n.range[i],t.sets[r])})}case`ProductSet`:{if(!S(e)){if(C(e))return!1;throw new r(Ee(e,t))}let n=Te(e);return n!==void 0&&n.length===t.factors.length&&n.every((e,n)=>P(e,t.factors[n]))}case`FilteredSet`:return P(e,t.base)&&t.test(e);case`SetOperation`:return t.operator===`\\cup`?P(e,t.left)||P(e,t.right):P(e,t.left)&&P(e,t.right)===(t.operator===`\\cap`);case`SequenceSet`:{let n=Te(e);if(n===void 0){if(C(e))return!1;throw new r(Ee(e,t))}return n.every(e=>P(e,t.base))}default:throw new r(`Expected a set but found ${I(t)}`)}},F=e=>{if(typeof e==`object`&&e.kind===`Function`)return e;if(typeof e==`object`&&e.kind===`LazyFunction`){let t=N(e.domain).elements;return O(t,t.map(t=>e.apply(t)))}throw new r(`Expected a function but found ${I(e)}`)},De=(e,t)=>{if(typeof e==`object`&&e.kind===`LazyFunction`){if(!P(t,e.domain))throw new r(`Attempted to apply a function to ${I(t)}, which is not in its domain`);return e.apply(t)}if(typeof e!=`object`||e.kind!==`Function`)throw new r(`Attempted to apply ${I(e)}, which is not a function`);let n=e.domain,i=n[0];if(typeof t==`number`&&typeof i==`number`){let r=t-i;if(n[r]===t)return e.range[r]}if(n.length<=8){for(let r=0;r<n.length;r++)if(n[r]===t)return e.range[r]}let a=we(n,t);if(a===-1)throw new r(`Attempted to apply function ${I(e)} to ${I(t)}, which is not in its domain`);return e.range[a]},Oe=e=>typeof e==`object`&&e.kind===`LazyFunction`?e.domain:D(F(e).domain),ke=(e,t,n)=>{if(typeof e==`object`&&e.kind===`LazyFunction`&&!M(e.domain)){if(!P(t,e.domain))return e;let r=n(e.apply(t));return{kind:`LazyFunction`,domain:e.domain,apply:n=>k(n,t)?r:e.apply(n)}}let r=F(e),i=we(r.domain,t);if(i===-1)return r;let a=[...r.range],o=r.range[i],s=n(o);a[i]=s;let c=O(r.domain,a);if(r.hash!==0){let e=r.domain[i];c.hash=o===s?r.hash:r.hash-Fe(e,o)+Fe(e,s)|0}if(r.fingerprint!==0){let e=r.domain[i];c.fingerprint=o===s?r.fingerprint:r.fingerprint-He(e,o)+He(e,s)|0}return c},Ae=/* @__PURE__ */ new WeakMap,je=e=>{let t=Math.imul(e^e>>>16,2246822507),n=Math.imul(t^t>>>13,3266489909);return n^n>>>16},Me=(e,t)=>Math.imul(e^t,16777619),Ne=e=>{let t=2166136261;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),16777619);return je(t)},Pe=e=>je(Le(e)+2654435769|0),Fe=(e,t)=>je(Math.imul(Le(e),668265261)+Le(t)|0),Ie=e=>{if(e.kind===`ModelValue`)return je(Me(Ne(e.name),109));if(x(e)){if(!M(e))return Ne(Ke(e));let t=N(e).elements,n=1940243425;for(let e=0;e<t.length;e++)n=n+Pe(t[e])|0;return n}let t=F(e),n=1725019383;for(let e=0;e<t.domain.length;e++)n=n+Fe(t.domain[e],t.range[e])|0;return n},Le=e=>{if(typeof e==`number`)return je(e^1540483477);if(typeof e==`boolean`)return e?729683222:682545830;if(typeof e==`string`)return Ne(e);if(e.kind===`Set`||e.kind===`Function`)return e.hash===0&&(e.hash=Ie(e)),e.hash;let t=Ae.get(e);if(t!==void 0)return t;let n=Ie(e);return Ae.set(e,n),n},Re=/* @__PURE__ */ new WeakMap,ze=e=>{let t=Math.imul(e^e>>>15,739982445),n=Math.imul(t^t>>>12,695872825);return n^n>>>15},Be=e=>{let t=2538058380;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),1540483477);return ze(t)},Ve=e=>ze(We(e)+2135587861|0),He=(e,t)=>ze(Math.imul(We(e),374761393)+We(t)|0),Ue=e=>{if(e.kind===`ModelValue`)return ze(Be(e.name)^60);if(x(e)){if(!M(e))return Be(Ke(e));let t=N(e).elements,n=461845907;for(let e=0;e<t.length;e++)n=n+Ve(t[e])|0;return n}let t=F(e),n=1291169091;for(let e=0;e<t.domain.length;e++)n=n+He(t.domain[e],t.range[e])|0;return n},We=e=>{if(typeof e==`number`)return ze(e^1759714724);if(typeof e==`boolean`)return e?1000000007:521288629;if(typeof e==`string`)return Be(e);if(e.kind===`Set`||e.kind===`Function`)return e.fingerprint===0&&(e.fingerprint=Ue(e)),e.fingerprint;let t=Re.get(e);if(t!==void 0)return t;let n=Ue(e);return Re.set(e,n),n},Ge=/* @__PURE__ */ new WeakMap,Ke=e=>{if(typeof e==`boolean`)return e?`T`:`F`;if(typeof e==`number`)return String(e);if(typeof e==`string`)return JSON.stringify(e);let t=Ge.get(e);if(t!==void 0)return t;let n=qe(e);return Ge.set(e,n),n},qe=e=>{if(e.kind===`ModelValue`)return`@${e.name}`;if(e.kind===`InfiniteSet`)return`<${e.name}>`;if(e.kind===`SequenceSet`)return`<Seq ${Ke(e.base)}>`;if(e.kind===`FilteredSet`&&!M(e))throw new r(`Attempted to compare the non-enumerable set ${I(e)} with another value`);if(x(e))return M(e)?`{${N(e).elements.map(Ke).join(`,`)}}`:`<${e.kind} ${I(e)}>`;let t=F(e);return`(${t.domain.map((e,n)=>`${Ke(e)}:${Ke(t.range[n])}`).join(`,`)})`},Je=e=>`"${e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`).replace(/\n/g,`\\n`).replace(/\t/g,`\\t`)}"`,Ye=(e,t)=>{let n=e=>I(e,t);switch(e.kind){case`Subset`:return`SUBSET ${n(e.base)}`;case`FunctionSet`:return`[${n(e.domain)} -> ${n(e.range)}]`;case`RecordSet`:return`[${e.names.map((t,r)=>`${t} : ${n(e.sets[r])}`).join(`, `)}]`;case`ProductSet`:return e.factors.map(n).join(` \\X `);case`SetOperation`:return`${n(e.left)} ${e.operator} ${n(e.right)}`;case`FilteredSet`:return`{x \\in ${n(e.base)} : ...}`}},I=(e,t=!1)=>{let n=e=>I(e,t);if(typeof e==`boolean`)return e?`TRUE`:`FALSE`;if(typeof e==`number`)return String(e);if(typeof e==`string`)return Je(e);switch(e.kind){case`ModelValue`:return e.name;case`Set`:return`{${e.elements.map(n).join(`, `)}}`;case`Interval`:return`${e.low}..${e.high}`;case`InfiniteSet`:return e.name===`Any`?`ANY`:e.name;case`Subset`:case`FunctionSet`:case`RecordSet`:case`ProductSet`:case`SetOperation`:case`FilteredSet`:return t&&M(e)?n(N(e)):Ye(e,t);case`SequenceSet`:return`Seq(${n(e.base)})`;case`Function`:case`LazyFunction`:{if(e.kind===`LazyFunction`&&!M(e.domain))return`<function>`;let t=F(e);return t.domain.every((e,t)=>e===t+1)?`<<${t.range.map(n).join(`, `)}>>`:t.domain.every(e=>typeof e==`string`&&e.length>0)?`[${t.domain.map((e,r)=>`${String(e)} |-> ${n(t.range[r])}`).join(`, `)}]`:`(${t.domain.map((e,r)=>`${n(e)} :> ${n(t.range[r])}`).join(` @@ `)})`}}},Xe=/* @__PURE__ */ new Set([`Apply`,`And`,`Or`,`If`,`FunctionApplication`,`FieldAccess`,`Record`,`Tuple`,`SetEnumeration`,`Prime`,`Unchanged`,`Forall`,`Exists`]),Ze=e=>`line ${e.location.line}, column ${e.location.column}`,Qe=()=>({bool:V,apply:De,tuple:j,set:A,record:O,equal:k,enumerate:Bn,unassigned:(e,t)=>{throw new r(`The variable ${e} is not assigned at ${Ze(t)}`)},primeOutsideAction:e=>{throw new r(`A primed expression appears outside an action at ${Ze(e)}`)},prime:e=>({environment:e.environment,scope:e.scope,state:e.next,next:void 0}),extend:(e,t,n)=>({environment:e.environment,scope:t.reduce((e,t,r)=>Pn(e,t,n[r]),e.scope),state:e.state,next:e.next})}),$e={value:void 0},et=(e,t)=>(e.references.push(t),`reference${e.references.length-1}`),tt=e=>`local${e.counter++}`,nt=(e,t=/* @__PURE__ */ new Set)=>(e.kind===`Identifier`&&t.add(e.name),e.kind===`Apply`&&t.add(e.operator),In(e).forEach(e=>nt(e,t)),t),rt=(e,t,n)=>{let r=et(e,U(t,e.environment)),i=nt(t),a=[...n.locals].filter(([e])=>i.has(e));if(a.length===0)return`${r}(${n.context})`;let o=et(e,a.map(([e])=>e));return`${r}(extend(${n.context}, ${o}, [${a.map(([,e])=>e).join(`, `)}]))`},it=(e,t,n)=>{let r=t.kind===`Forall`,i=JSON.stringify(r?`the body of \\A`:`the body of \\E`),a=`quantifier${e.counter++}`,o=[...n.locals.values()],s={context:`context`,state:`state`,next:`next`,isPrimed:!1,locals:new Map(n.locals)},c=t.bounds.map(()=>tt(e)),l=t.bounds.map((t,n)=>`const ${c[n]} = enumerate(${ot(e,t.set,s)}, ${et(e,t.set)});`),u=t.bounds.map(t=>{let n=tt(e);return t.pattern.kind===`Name`&&s.locals.set(t.pattern.name,n),n}),d=`if (bool(${ot(e,t.body,s)}, ${i}) !== ${r}) return ${!r};`,f=u.reduce((t,n,r)=>{let i=tt(e);return`for (let ${i} = 0; ${i} < ${c[r]}.length; ${i}++) { const ${n} = ${c[r]}[${i}]; ${t} }`},d),p=o.map(e=>`, ${e}`).join(``);return e.helpers.push(`function ${a}(context, state, next${p}) { let primed; ${l.join(` `)} ${f} return ${r}; }`),`${a}(${n.context}, ${n.state}, ${n.isPrimed?`undefined`:n.next}${p})`},at=(e,t,n)=>{let r=t.args;if(t.operator===`=>`)return`(bool(${ot(e,r[0],n)}, "the left side of =>") ? bool(${ot(e,r[1],n)}, "the right side of =>") : true)`;if(H(t))return rt(e,t,n);let i=Xn(t.operator,e.environment);if(i?.kind!==`Builtin`)return rt(e,t,n);let a=e.environment;if(i.evaluateUnary&&r.length===1&&Nr(r[0],a))return`${et(e,i.evaluateUnary)}(${ot(e,r[0],n)})`;let o=r.length===2&&Nr(r[0],a)&&Nr(r[1],a);return i.evaluateBinary&&o?`${et(e,i.evaluateBinary)}(${ot(e,r[0],n)}, ${ot(e,r[1],n)})`:rt(e,t,n)},ot=(e,t,n)=>{let r=(t,r=n)=>ot(e,t,r);if(Cr(t)&&vr(t,e.environment))return rt(e,t,n);switch(t.kind){case`Number`:return Number.isInteger(t.value)&&Math.abs(t.value)<=2147483647?String(t.value):rt(e,t,n);case`String`:return JSON.stringify(t.value);case`Identifier`:{let r=n.locals.get(t.name);if(r)return r;if(H(t))return rt(e,t,n);let i=or(t.name,e.environment);if(i?.kind===`Variable`){let r=JSON.stringify(t.name),a=et(e,t);return`(${n.state}?.[${i.index}] ?? unassigned(${r}, ${a}))`}return i?.kind===`Value`?et(e,i.value):rt(e,t,n)}case`Apply`:return at(e,t,n);case`And`:return`(${t.operands.map(e=>`bool(${r(e)}, "a conjunct")`).join(` && `)})`;case`Or`:return`(${t.operands.map(e=>`bool(${r(e)}, "a disjunct")`).join(` || `)})`;case`If`:return`(bool(${r(t.condition)}, "an IF condition") ? ${r(t.consequent)} : ${r(t.alternative)})`;case`FunctionApplication`:{let e=r(t.function);return t.args.length===1?`apply(${e}, ${r(t.args[0])})`:`apply(${e}, tuple([${t.args.map(e=>r(e)).join(`, `)}]))`}case`FieldAccess`:return`apply(${r(t.record)}, ${JSON.stringify(t.field)})`;case`Record`:{let i=[...t.fields].sort((e,t)=>e.name<t.name?-1:1);return i.some((e,t)=>t>0&&i[t-1].name===e.name)?rt(e,t,n):`record(${et(e,i.map(e=>e.name))}, [${i.map(e=>r(e.value)).join(`, `)}])`}case`Tuple`:return`tuple([${t.elements.map(e=>r(e)).join(`, `)}])`;case`SetEnumeration`:return`set([${t.elements.map(e=>r(e)).join(`, `)}])`;case`Prime`:{let i=et(e,t);if(n.isPrimed)return`primeOutsideAction(${i})`;let a={context:`(primed ??= prime(${n.context}))`,state:n.next,next:`undefined`,isPrimed:!0,locals:n.locals};return`(${n.next} === undefined ? primeOutsideAction(${i}) : ${r(t.expression,a)})`}case`Unchanged`:return`equal(${r({kind:`Prime`,expression:t.expression,location:t.location})}, ${r(t.expression)})`;case`Forall`:case`Exists`:return t.bounds.every(e=>e.pattern.kind===`Name`)?it(e,t,n):rt(e,t,n);default:return rt(e,t,n)}},st=(e,t)=>{if(!Xe.has(e.kind))return;let n={environment:t,references:[],helpers:[],counter:0},r=ot(n,e,{context:`context`,state:`state`,next:`next`,isPrimed:!1,locals:/* @__PURE__ */ new Map}),i=n.references.map((e,t)=>`reference${t}`),a=`${n.helpers.join(`
-`)}\nreturn (context) => { const state = context.state; const next = context.next; let primed; return ${r}; };`;$e.value??=Qe();let o=$e.value,s=Object.keys(o);return Function(...s,...i,a)(...Object.values(o),...n.references)},ct={kind:`Local`},lt=/* @__PURE__ */ new WeakMap,ut=new Map([`~>`,`-+->`,`\\cdot`].map(e=>[e,{key:e,arity:2}])),dt=(e,t)=>e.line<t.line||e.line===t.line&&e.column<t.column,ft=e=>e.kind===`Operator`?e.params.length:0,pt=e=>e.name.includes(`!`),mt=(e,t)=>{for(let n=e;n;n=n.parent)if(n.name===t)return n},ht=(e,t,n=0)=>t.reduce((e,t)=>({name:t,arity:n,parent:e}),e),gt=e=>e.kind===`Name`?[e.name]:e.names,_t=(e,n,r,i)=>{let a=e.location,o=lt.get(e);if(o!==void 0)return o;if(n.includes(`@`))return e.kind===`Apply`?e.args.length:0;let s=mt(r,n);if(s&&e.kind!==`OperatorReference`&&(e.resolution=ct),s)return s.arity;let c=i.definitions.get(n),l=c!==void 0&&(c===i.self?c.kind===`Function`||c.isRecursive:c.isRecursive||dt(c.location,i.location)),u=c&&l?{key:i.getKey(c),arity:ft(c)}:i.imported.get(n);if(u)return e.kind===`Identifier`?e.name=u.key:e.operator=u.key,lt.set(e,u.arity),u.arity;throw new t(`Could not find declaration or definition of symbol ${n} at line ${a.line}, column ${a.column}`)},vt=(e,t,n)=>(e.forEach(e=>L(e.set,t,n)),e.reduce((e,t)=>ht(e,gt(t.pattern)),t)),yt=(e,t)=>e.kind===`Identifier`&&e.name===t&&H(e)||In(e).some(e=>yt(e,t)),bt=(e,t)=>{e.kind===`FunctionConstruction`&&yt(e.body,t)&&(e.isRecursive=!0),In(e).forEach(e=>bt(e,t))},xt=(e,t,n)=>{let r=ht(t,e.kind===`Function`?[e.name]:[]);if(e.kind===`Function`){L(e.body,vt(e.bounds,r,n),n),bt(e.body,e.name);return}let i=e.params.reduce((e,t)=>({name:t.name,arity:t.arity,parent:e}),r);L(e.body,i,n)},St=(e,t,n)=>{let r=e.filter(e=>e.isRecursive).reduce((e,t)=>({name:t.name,arity:ft(t),parent:e}),t);return e.reduce((e,t)=>(pt(t)||xt(t,e,n),{name:t.name,arity:ft(t),parent:e}),r)},Ct=(e,n,r)=>{let i=_t(e,e.operator,n,r);if(i!==e.args.length)throw new t(`The operator ${e.operator} requires ${i} arguments at line ${e.location.line}, column ${e.location.column}`);e.args.forEach(e=>e.kind===`Identifier`?_t(e,e.name,n,r):L(e,n,r))},L=(e,n,r)=>{let i=e=>e.forEach(e=>L(e,n,r));switch(e.kind){case`Number`:case`String`:case`ExceptAt`:return;case`Identifier`:{let i=_t(e,e.name,n,r);if(i>0)throw new t(`The operator ${e.name} requires ${i} arguments at line ${e.location.line}, column ${e.location.column}`);return}case`OperatorReference`:_t(e,e.operator,n,r);return;case`Apply`:Ct(e,n,r);return;case`Lambda`:L(e.body,ht(n,e.params),r);return;case`And`:case`Or`:i(e.operands);return;case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:L(e.expression,n,r);return;case`If`:i([e.condition,e.consequent,e.alternative]);return;case`Case`:i(e.arms.flatMap(e=>[e.condition,e.body])),e.other&&L(e.other,n,r);return;case`Let`:L(e.body,St(e.definitions,n,r),r);return;case`Forall`:case`Exists`:case`FunctionConstruction`:L(e.body,vt(e.bounds,n,r),r);return;case`UnboundedQuantifier`:L(e.body,ht(n,e.names),r);return;case`Choose`:e.set&&L(e.set,n,r),L(e.body,ht(n,gt(e.pattern)),r);return;case`SetEnumeration`:case`Tuple`:i(e.elements);return;case`SetFilter`:L(e.predicate,vt([e.bound],n,r),r);return;case`SetMap`:L(e.expression,vt(e.bounds,n,r),r);return;case`FunctionSet`:i([e.domain,e.range]);return;case`Record`:case`RecordSet`:if(new Set(e.fields.map(e=>e.name)).size<e.fields.length)throw new t(`Non-unique fields in constructor at line ${e.location.line}, column ${e.location.column}`);i(e.fields.map(e=>e.value));return;case`Except`:i([e.function,...e.updates.flatMap(e=>[...e.path.flatMap(e=>e.kind===`Index`?e.args:[]),e.value])]);return;case`FunctionApplication`:i([e.function,...e.args]);return;case`FieldAccess`:L(e.record,n,r);return;case`Product`:i(e.factors);return;case`BoxAction`:case`AngleAction`:i([e.action,e.subscript]);return;case`WeakFairness`:case`StrongFairness`:i([e.subscript,e.action]);return;case`Label`:L(e.body,n,r);return;case`Subexpression`:i(e.selectors.flatMap(e=>`args`in e?e.args:[]))}},wt=(e,t)=>{let n=new Map([...ut,...t]);return e.constants.forEach(e=>n.set(e.name,{key:e.name,arity:e.arity})),e.variables.forEach(e=>n.set(e,{key:e,arity:0})),n},Tt=(e,t,n,r)=>{let i=ht(void 0,e.params.map(e=>e.name)),a={imported:wt(n,r.imported),definitions:r.definitions,getKey:r.getKey,location:e.location,self:void 0},o=new Map(e.substitutions.map(e=>[e.name,e.expression]));return new Map(t.map(t=>{let n=o.get(t.name)??{kind:`Identifier`,name:t.name,location:e.location};return t.arity>0&&n.kind===`Identifier`?_t(n,n.name,i,a):L(n,i,a),[t.name,n]}))},Et=(e,t)=>{let n=wt(e,t.imported),r=(e,r)=>({imported:n,definitions:t.definitions,getKey:t.getKey,location:e,self:r});e.definitions.forEach(e=>xt(e,void 0,r(e.location,e))),e.assumptions.forEach(e=>L(e.expression,void 0,r(e.location,void 0)))},Dt=e=>e.kind===`Name`?[e.name]:e.names,Ot=e=>e.flatMap(e=>Dt(e.pattern)),kt=/* @__PURE__ */ new WeakSet,At=(e,t,n=/* @__PURE__ */ new Set)=>{let r=Nt(e,(e,r)=>At(e,t,r.length===0?n:/* @__PURE__ */ new Set([...n,...r])));return r.kind===`Identifier`&&H(r)&&!n.has(r.name)?{...r,name:t.get(r.name)??r.name}:r.kind===`Apply`&&H(r)&&!n.has(r.operator)?{...r,operator:t.get(r.operator)??r.operator}:r},jt=(e,t)=>e.map(e=>({pattern:e.pattern,set:t(e.set)})),Mt=(e,t)=>e.kind===`Function`?{...e,bounds:jt(e.bounds,e=>t(e,[])),body:t(e.body,Ot(e.bounds))}:{...e,body:t(e.body,e.params.map(e=>e.name))},Nt=(e,t)=>{let n=e=>t(e,[]);switch(e.kind){case`Number`:case`String`:case`Identifier`:case`OperatorReference`:case`ExceptAt`:return e;case`Apply`:return{...e,args:e.args.map(n)};case`Lambda`:return{...e,body:t(e.body,e.params)};case`And`:case`Or`:return{...e,operands:e.operands.map(n)};case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return{...e,expression:n(e.expression)};case`If`:return{...e,condition:n(e.condition),consequent:n(e.consequent),alternative:n(e.alternative)};case`Case`:return{...e,arms:e.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),other:e.other?n(e.other):void 0};case`Let`:{let n=e.definitions.map(e=>e.name);return{...e,definitions:e.definitions.map(e=>Mt(e,(e,r)=>t(e,[...n,...r]))),body:t(e.body,n)}}case`Forall`:case`Exists`:case`FunctionConstruction`:return{...e,bounds:jt(e.bounds,n),body:t(e.body,Ot(e.bounds))};case`UnboundedQuantifier`:return{...e,body:t(e.body,e.names)};case`Choose`:return{...e,set:e.set?n(e.set):void 0,body:t(e.body,Dt(e.pattern))};case`SetEnumeration`:case`Tuple`:return{...e,elements:e.elements.map(n)};case`SetFilter`:return{...e,bound:{pattern:e.bound.pattern,set:n(e.bound.set)},predicate:t(e.predicate,Dt(e.bound.pattern))};case`SetMap`:return{...e,bounds:jt(e.bounds,n),expression:t(e.expression,Ot(e.bounds))};case`FunctionSet`:return{...e,domain:n(e.domain),range:n(e.range)};case`Record`:case`RecordSet`:return{...e,fields:e.fields.map(e=>({name:e.name,value:n(e.value)}))};case`Except`:return{...e,function:n(e.function),updates:e.updates.map(e=>({path:e.path.map(e=>e.kind===`Index`?{kind:`Index`,args:e.args.map(n)}:e),value:n(e.value)}))};case`FunctionApplication`:return{...e,function:n(e.function),args:e.args.map(n)};case`FieldAccess`:return{...e,record:n(e.record)};case`Product`:return{...e,factors:e.factors.map(n)};case`BoxAction`:case`AngleAction`:return{...e,action:n(e.action),subscript:n(e.subscript)};case`WeakFairness`:case`StrongFairness`:return{...e,subscript:n(e.subscript),action:n(e.action)};case`Label`:return{...e,body:n(e.body)};case`Subexpression`:return{...e,selectors:e.selectors.map(e=>`args`in e?{...e,args:e.args.map(n)}:e)}}},Pt=e=>`${e}@ENABLED`,Ft=(e,t)=>e.modes.get(t)??e,It=(e,t,n)=>e.kind===`Identifier`&&!n.has(e.name)&&!H(e)&&t.instantiation.variables.has(e.name),Lt=(e,t,n)=>{if(e.kind===`Tuple`){let r=e.elements.map(e=>Lt(e,t,n));return r.every(e=>e!==void 0)?r.flat():void 0}if(e.kind!==`Identifier`)return;if(It(e,t,n))return[e.name];let r=H(e)?void 0:t.instantiation.getDefinition(e.name);return r?.kind===`Operator`&&r.params.length===0?Lt(r.body,t,/* @__PURE__ */ new Set):void 0},Rt=(e,t,n)=>{if(t.mode===`Normal`)return;if(t.mode===`Primed`)return It(e,t,n)&&e.kind===`Identifier`?{kind:`Identifier`,name:Pt(e.name),location:e.location}:void 0;if(e.kind===`Prime`)return{...e,expression:Ut(e.expression,Ft(t,`Primed`),n)};if(e.kind===`AngleAction`){let r=e.location;return{kind:`And`,operands:[Ut(e.action,t,n),{kind:`Apply`,operator:`#`,args:[{kind:`Prime`,expression:Ut(e.subscript,Ft(t,`Primed`),n),location:r},Ut(e.subscript,t,n)],location:r}],location:r}}if(e.kind!==`Unchanged`)return;let r=Lt(e.expression,t,n);if(r!==void 0)return{kind:`And`,operands:r.map(r=>({kind:`Apply`,operator:`=`,args:[{kind:`Prime`,expression:{kind:`Identifier`,name:Pt(r),location:e.location},location:e.location},Ut({kind:`Identifier`,name:r,location:e.location},t,n)],location:e.location})),location:e.location}},zt=(e,t)=>e.map(e=>({kind:`Identifier`,name:e.name,location:t,resolution:{kind:`Local`}})),Bt=e=>e.kind===`Operator`?e.params.length:0,Vt=(e,t,n,r)=>{let i=Array.from({length:n},(e,t)=>`argument${t}`);return{kind:`Lambda`,params:i,body:{kind:`Apply`,operator:e,args:[...zt(t,r),...i.map(e=>({kind:`Identifier`,name:e,location:r,resolution:{kind:`Local`}}))],location:r},location:r}},Ht=(e,t)=>e.instantiation.isParameterized(t)?Gt(e,t):void 0,Ut=(e,n,r)=>{let i=e=>Ut(e,n,r),a=n.instantiation,o=a.params,s=t=>!r.has(t)&&!H(e);if(e.kind===`Enabled`&&n.mode===`Normal`)return{...e,expression:Ut(e.expression,Ft(n,`Enabled`),r)};if((e.kind===`WeakFairness`||e.kind===`StrongFairness`)&&n.mode===`Normal`){let t=Ft(n,`Enabled`);return{...e,subscript:i(e.subscript),action:i(e.action),enabled:Ut(e.enabled??{kind:`AngleAction`,action:e.action,subscript:e.subscript,location:e.location},t,r)}}let c=Rt(e,n,r);if(c)return c;if(e.kind===`Identifier`&&s(e.name)){let t=a.substitutions.get(e.name);if(t)return kt.add(t),t;let r=Ht(n,e.name);if(r===void 0)return e;if(o.length===0)return{...e,name:r};let i=a.getDefinition(e.name);return i&&Bt(i)>0?Vt(r,o,Bt(i),e.location):{kind:`Apply`,operator:r,args:zt(o,e.location),location:e.location}}if(e.kind===`Apply`&&s(e.operator)){let r=e.args.map(i),s=a.substitutions.get(e.operator);if(s?.kind===`Identifier`||s?.kind===`OperatorReference`){let t=s.kind===`Identifier`?s.name:s.operator;return{...e,operator:t,args:r,resolution:s.kind===`Identifier`?s.resolution:void 0}}if(s?.kind===`Apply`)return{...e,operator:s.operator,args:[...s.args,...r],resolution:s.resolution};if(s?.kind===`Lambda`)return{kind:`Let`,definitions:[{kind:`Operator`,name:s.kind,params:s.params.map(e=>({name:e,arity:0})),body:s.body,isLocal:!0,isRecursive:!1,location:s.location}],body:{...e,operator:s.kind,args:r,resolution:{kind:`Local`}},location:e.location};if(s)throw new t(`The operator ${e.operator} can only be substituted by an operator at line ${e.location.line}, column ${e.location.column}`);let c=Ht(n,e.operator);return c===void 0?{...e,args:r}:{...e,operator:c,args:[...zt(o,e.location),...r]}}if(e.kind===`OperatorReference`&&s(e.operator)){let t=Ht(n,e.operator);if(t===void 0)return e;let r=a.getDefinition(e.operator);return o.length>0&&r?Vt(t,o,Bt(r),e.location):{...e,operator:t}}return Nt(e,(e,t)=>t.length===0?i(e):Ut(e,n,/* @__PURE__ */ new Set([...r,...t])))},Wt=(e,t,n)=>t.length===0?e:e.kind===`Operator`?{...e,params:[...t,...e.params]}:{kind:`Operator`,name:e.name,params:t,body:{kind:`Let`,definitions:[e],body:{kind:`Identifier`,name:e.name,location:n,resolution:{kind:`Local`}},location:n},isLocal:e.isLocal,isRecursive:!1,location:e.location},Gt=(e,t)=>{let n=e.copies.get(t);if(n!==void 0)return n;let r=e.instantiation,i=r.getDefinition(t);return i?r.addDefinition(i.name,n=>{e.copies.set(t,n);let a=Mt(i,(t,n)=>Ut(t,e,new Set(n)));return Wt(a,r.params,i.location)}):t},Kt=e=>{let t=/* @__PURE__ */ new Map,n=n=>{let r={instantiation:e,copies:/* @__PURE__ */ new Map,mode:n,modes:t};return t.set(n,r),r},r=n(`Normal`);return n(`Enabled`),n(`Primed`),{getKey:e=>Ht(r,e)??e,getQualifiedKey:t=>{let n=Ht(r,t);if(n!==void 0)return n;let i=e.getDefinition(t);return i?e.addDefinition(i.name,()=>Wt(i,e.params,i.location)):t}}},qt=e=>e.kind===`Let`&&e.instances!==void 0||In(e).some(qt),Jt=(e,t)=>{let n=Nt(e,e=>Jt(e,t));return n.kind!==`Let`||!n.instances?n:{kind:`Let`,definitions:n.instances.reduce((e,n)=>{let r=e.findIndex(e=>dt(n.location,e.location)),i=r===-1?e.length:r;return[...e.slice(0,i),...t(n),...e.slice(i)]},n.definitions),body:n.body,location:n.location}},Yt=(e,t)=>e.definitions.some(e=>qt(e.body))||e.assumptions.some(e=>qt(e.expression))?{...e,definitions:e.definitions.map(e=>Mt(e,e=>Jt(e,t))),assumptions:e.assumptions.map(e=>({...e,expression:Jt(e.expression,t)}))}:e,Xt=/* @__PURE__ */ new WeakMap,Zt=/* @__PURE__ */ new WeakMap,Qt=e=>`line ${e.location.line}, column ${e.location.column}`,R=(e,t,n)=>e.isInit?{environment:e.environment,scope:t,state:n,next:void 0}:{environment:e.environment,scope:t,state:e.current,next:n},$t=(e,t,n)=>{let r=e.slice();return r[t]=n,r},en=(e,t)=>{let n=W(e,t);return typeof n==`boolean`?n:V(n,`the action at ${Qt(e)}`)},tn=e=>e===`=`||e===`\\in`||e===`\\subseteq`,nn=(e,t,n)=>{let r=n?Xt:Zt,i=r.get(e);if(i)return i;let a=Tn(e,t,n);return r.set(e,a),a},rn=(e,t)=>{if(t.constants.has(e))return;let n=Ln(e,t);return n?.kind===`Operator`&&n.params.length===0?n:void 0},an=(e,t,n,r=/* @__PURE__ */ new Set)=>{if(e.kind===`Prime`&&n)return an(e.expression,t,!1,r);if(e.kind!==`Identifier`||H(e))return;let i=t.variableIndex.get(e.name);if(i!==void 0)return n?void 0:i;let a=rn(e.name,t);if(a&&!r.has(a))return r.add(a),an(a.body,t,n,r)},on=(e,t,n)=>an(e,t,!n),sn=(e,t,n,r,i)=>{if(e.kind===`Prime`&&i)return sn(e.expression,t,n,r,!1);if(e.kind===`Let`){let a=fr(e.definitions,R(r,t,n));return sn(e.body,a,n,r,i)}if(e.kind!==`Identifier`)return;let a=Nn(t,e.name);if(a?.kind===`Thunk`)return sn(a.expression,a.scope,n,r,i);if(a)return;let o=r.environment.variableIndex.get(e.name);if(o!==void 0)return i?void 0:o;let s=rn(e.name,r.environment);if(s)return sn(s.body,void 0,n,r,i)},cn=(e,t)=>e.kind===`Let`||e.kind===`Identifier`&&(t||H(e))||!t&&e.kind===`Prime`,ln=(e,t,n=/* @__PURE__ */ new Set)=>{if(e.kind===`Tuple`){let r=e.elements.map(e=>ln(e,t,n));return r.every(e=>e!==void 0)?r.flat():void 0}if(e.kind!==`Identifier`||n.has(e.name))return;let r=t.variableIndex.get(e.name);if(r!==void 0)return[r];let i=rn(e.name,t);if(i)return n.add(e.name),ln(i.body,t,n)},un=/* @__PURE__ */ new Set([`Label`,`And`,`Or`,`Exists`,`Forall`,`If`,`Case`,`Let`,`Unchanged`,`BoxAction`,`AngleAction`,`FunctionApplication`]),dn=(e,t,n)=>un.has(e.kind)?!1:e.kind===`Identifier`?!!(t.variableIndex.has(e.name)||t.constants.has(e.name)):e.kind===`Apply`?e.operator===`=>`||tn(e.operator)&&(cn(e.args[0],n)||on(e.args[0],t,n)!==void 0)||H(e)?!1:t.definitions.get(t.substitutions.get(e.operator)??e.operator)===void 0&&t.builtins.has(e.operator):!0,fn=(e,t,n)=>{if(e.kind===`Apply`&&e.operator===`=`){let r=on(e.args[0],t,n);if(r!==void 0)return{kind:`Assign`,expression:e,index:r,value:e.args[1]}}if(!n&&e.kind===`Unchanged`){let n=ln(e.expression,t);if(n)return{kind:`Unchanged`,expression:e,indices:n}}return dn(e,t,n)?{kind:`Guard`,expression:e}:{kind:`Branch`,expression:e,runner:nn(e,t,n)}},pn=(e,t,n)=>{let r=e.map(e=>fn(e,t,n)),i=(e,t,n,a,o,s)=>{let c=a,l;for(let a=e;a<r.length;a++){if(a>0&&t.isInit&&kn(c)){l??=R(t,n,c);for(let e=a;e<r.length;e++)if(!mn(r[e].expression,l))return;s(c,o);return}let e=r[a];if(e.kind===`Guard`){if(l??=R(t,n,c),!en(e.expression,l))return;continue}if(e.kind===`Assign`){l??=R(t,n,c);let r=W(e.value,l),i=c[e.index];if(i===void 0)c=$t(c,e.index,r),l=void 0;else if(!k(i,r))return;continue}if(e.kind===`Unchanged`){let n=t.current;if(!n)return;for(let t of e.indices){let e=c[t];if(e===void 0)c=$t(c,t,n[t]),l=void 0;else if(!k(e,n[t]))return}continue}let u=a+1;e.runner(t,n,c,o,!0,(e,r)=>i(u,t,n,e,r,s));return}s(c,o)};return(e,t,n,r,a,o)=>i(0,e,t,n,r,o)},mn=(e,t)=>V(W(e,t),`the initial predicate at ${Qt(e)}`),hn=e=>(t,n,r,i,a,o)=>{en(e,R(t,n,r))&&o(r,i)},gn=(e,t)=>{let n=e.args[1];return(i,a,o,s,c,l)=>{let u=t(i,a,o),d=R(i,a,o);if(o[u]!==void 0){en(e,d)&&l(o,s);return}let f=W(n,d),p=e.operator===`\\subseteq`?{kind:`Subset`,base:f}:f;if(!M(p))throw new r(`In computing next states, the right side of \\in is not enumerable: ${I(p)} at ${Qt(e)}`);let m=N(p).elements;for(let e=0;e<m.length;e++)l($t(o,u,m[e]),s)}},_n=/* @__PURE__ */ new WeakMap,vn=e=>{let t=_n.get(e);if(t)return t;let n=e.kind===`Tuple`?{kind:`And`,operands:e.elements.map(vn),location:e.location}:{kind:`Unchanged`,expression:e,location:e.location};return _n.set(e,n),n},yn=(e,t)=>{let n=e.args[0],r=hn(e),i=(e,r,i)=>sn(n,r,i,e,!t)??-1,a=gn(e,i);return(t,n,o,s,c,l)=>{let u=i(t,n,o);if(u===-1||o[u]!==void 0){r(t,n,o,s,c,l);return}if(e.operator!==`=`){a(t,n,o,s,c,l);return}let d=W(e.args[1],R(t,n,o));l($t(o,u,d),s)}},bn=(e,t,n,r)=>{if(e.kind===`FunctionConstruction`)return{bounds:e.bounds,body:e.body,scope:t};if(e.kind!==`Identifier`)return;let i=Nn(t,e.name);if(i?.kind===`Thunk`)return bn(i.expression,i.scope,n,r);let a=i?void 0:Ln(e.name,r.environment);if(a?.kind!==`Function`)return;let o=W(e,R(r,void 0,n));return{bounds:a.bounds,body:a.body,scope:Pn(void 0,a.name,o)}},xn=(e,t,n)=>{let i=hn(e);return(a,o,s,c,l,u)=>{let d=bn(e.function,o,s,a);if(!d){i(a,o,s,c,l,u);return}let f=R(a,o,s),p=e.args.map(e=>W(e,f)),m=p.length===1?p[0]:j(p),h=Hn(d.bounds,R(a,d.scope,s));if(!P(m,h))throw new r(`Attempted to apply a function to ${I(m)}, which is not in its domain at ${Qt(e)}`);nn(d.body,t,n)(a,Un(d.bounds,d.scope,m),s,c,l,u)}},Sn=(e,t)=>{if(ln(e,t))return pn([vn(e)],t,!1);if(e.kind===`Tuple`)return nn(vn(e),t,!1);let n=vn(e);return(r,i,a,o,s,c)=>{let l=e.kind===`Identifier`?Nn(i,e.name):void 0;l?.kind===`Thunk`?nn(vn(l.expression),t,!1)(r,l.scope,a,o,s,c):en(n,R(r,i,a))&&c(a,o)}},Cn=(e,t,n)=>{let r=e.operator,i=hn(e),a=H(e)?void 0:Xn(r,t);if(a?.kind===`Builtin`)return i;if(a?.kind===`Closure`){let i=Ir(a,e.args,t),o={body:void 0};return(e,s,c,l,u,d)=>{o.body??=nn(a.body,t,n),o.body(e,i(R(e,s,c)),c,u?l:r,u,d)}}return(a,o,s,c,l,u)=>{let d=R(a,o,s),f=Qn(e,d);f?.kind===`Closure`?nn(f.body,t,n)(a,ur(f,e.args,d),s,l?c:r,l,u):i(a,o,s,c,l,u)}},wn=(e,t,n)=>{let r=hn(e),i=H(e)?void 0:rn(e.name,t),a={body:void 0};return(o,s,c,l,u,d)=>{let f=Nn(s,e.name);f?.kind===`Thunk`?nn(f.expression,t,n)(o,f.scope,c,l,u,d):f||!i?r(o,s,c,l,u,d):(a.body??=nn(i.body,t,n),a.body(o,void 0,c,u?l:i.name,u,d))}},Tn=(e,t,n)=>{let i=e=>nn(e,t,n);switch(e.kind){case`And`:return pn(e.operands,t,n);case`Or`:{let t=e.operands.map(i);return(e,n,r,i,a,o)=>{for(let s of t)s(e,n,r,i,a,o)}}case`Exists`:{let t=i(e.body),n=e.bounds[0];if(e.bounds.length===1&&n.pattern.kind===`Name`){let e=n.pattern.name;return(i,a,o,s,c,l)=>{let u=W(n.set,R(i,a,o));if(!M(u))throw new r(`TLC encountered a non-enumerable quantifier bound ${I(u)} at ${Qt(n.set)}`);let d=N(u).elements;for(let n=0;n<d.length;n++)t(i,Pn(a,e,d[n]),o,s,c,l)}}return(n,r,i,a,o,s)=>{Vn(e.bounds,R(n,r,i),e=>(t(n,e,i,a,o,s),!1))}}case`Forall`:{let t=i(e.body);return(n,r,i,a,o,s)=>{let c=[];Vn(e.bounds,R(n,r,i),e=>(c.push(e),!1));let l=[...c.slice(0,1),...c.slice(1).reverse()],u=(r,i,a)=>{r===l.length?s(i,a):r>0&&n.isInit&&kn(i)?l.slice(r).every(t=>mn(e.body,R(n,t,i)))&&s(i,a):t(n,l[r],i,a,!0,(e,t)=>u(r+1,e,t))};u(0,i,a)}}case`If`:{let t=i(e.consequent),n=i(e.alternative);return(r,i,a,o,s,c)=>{let l=W(e.condition,R(r,i,a));(V(l,`an IF condition`)?t:n)(r,i,a,o,s,c)}}case`Case`:{let t=e.arms.map(e=>({condition:e.condition,body:i(e.body)})),n=e.other?i(e.other):void 0;return(i,a,o,s,c,l)=>{let u=R(i,a,o),d=t.find(e=>V(W(e.condition,u),`a CASE guard`))?.body??n;if(!d)throw new r(`No CASE guard is true at ${Qt(e)}`);d(i,a,o,s,c,l)}}case`Let`:{let t=i(e.body);return(n,r,i,a,o,s)=>t(n,fr(e.definitions,R(n,r,i)),i,a,o,s)}case`Unchanged`:return n?()=>{throw new r(`UNCHANGED appears in an initial predicate at ${Qt(e)}`)}:Sn(e.expression,t);case`AngleAction`:{let t=i(e.action),n=vn(e.subscript);return(e,r,i,a,o,s)=>t(e,r,i,a,o,(t,i)=>{en(n,R(e,r,t))||s(t,i)})}case`BoxAction`:return i({kind:`Or`,operands:[e.action,vn(e.subscript)],location:e.location});case`Label`:return i(e.body);case`Identifier`:return wn(e,t,n);case`FunctionApplication`:return xn(e,t,n);case`Apply`:{let r=e.args;if(tn(e.operator)){let i=on(r[0],t,n);if(i!==void 0)return e.operator===`=`?pn([e],t,n):gn(e,()=>i);if(cn(r[0],n))return yn(e,n)}if(e.operator===`=>`){let e=i(r[1]);return(t,n,i,a,o,s)=>{let c=W(r[0],R(t,n,i));(typeof c==`boolean`?c:V(c,`the left side of => at ${Qt(r[0])}`))?e(t,n,i,a,o,s):s(i,a)}}return Cn(e,t,n)}default:return hn(e)}},En=/* @__PURE__ */ new WeakMap,Dn=e=>{let t=En.get(e);if(t)return t;let n=e.variables.map(()=>void 0);return En.set(e,n),n},On=(e,t)=>t.variables.filter((t,n)=>e[n]===void 0),kn=e=>{for(let t=0;t<e.length;t++)if(e[t]===void 0)return!1;return!0},An=(e,t)=>{let n=t.state;if(!n||!kn(n))throw new r(`ENABLED needs a complete state at ${Qt(e)}`);let i=t.environment,a={value:!1};return nn(e,i,!1)({environment:i,isInit:!1,current:n},t.scope,Dn(i),void 0,!1,()=>{a.value=!0}),a.value},jn=(e,t)=>{let n=[],i={environment:t,isInit:!0,current:void 0};return nn(e,t,!0)(i,void 0,Dn(t),void 0,!1,e=>{if(!kn(e))throw new r(`The initial predicate does not assign ${On(e,t).join(`, `)}`);n.push(e)}),n},Mn=(e,t,n)=>{let i=[],a={environment:n,isInit:!1,current:t};return nn(e,n,!1)(a,void 0,Dn(n),void 0,!1,(e,t)=>{if(!kn(e))throw new r(`Successor state is not completely specified by action ${t??`Next`}. The following variables are not assigned: ${On(e,n).join(`, `)}`);i.push({state:e,action:t})}),i},z=e=>`line ${e.location.line}, column ${e.location.column}`,Nn=(e,t)=>{for(let n=e;n;n=n.parent)if(n.name===t)return n.binding},Pn=(e,t,n)=>({name:t,binding:{kind:`Value`,value:n},parent:e}),Fn=(e,t,n)=>{if(t.kind===`Name`)return Pn(e,t.name,n);let i=Te(n);if(!i||i.length!==t.names.length)throw new r(`Cannot bind <<${t.names.join(`, `)}>> to ${I(n)}, which is not a tuple of that length`);return t.names.reduce((e,t,n)=>Pn(e,t,i[n]),e)},B=(e,t)=>({environment:e.environment,scope:t,state:e.state,next:e.next}),V=(e,t)=>{if(typeof e!=`boolean`)throw new r(`Expected ${t} to be a boolean but found ${I(e)}`);return e},In=e=>{switch(e.kind){case`Number`:case`String`:case`Identifier`:case`OperatorReference`:case`ExceptAt`:return[];case`Apply`:return e.args;case`Lambda`:return[e.body];case`And`:case`Or`:return e.operands;case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return[e.expression];case`If`:return[e.condition,e.consequent,e.alternative];case`Case`:return[...e.arms.flatMap(e=>[e.condition,e.body]),...e.other?[e.other]:[]];case`Let`:return[...e.definitions.flatMap(e=>e.kind===`Function`?[...e.bounds.map(e=>e.set),e.body]:[e.body]),e.body];case`Forall`:case`Exists`:return[...e.bounds.map(e=>e.set),e.body];case`UnboundedQuantifier`:return[e.body];case`Choose`:return[...e.set?[e.set]:[],e.body];case`SetEnumeration`:case`Tuple`:return e.elements;case`SetFilter`:return[e.bound.set,e.predicate];case`SetMap`:return[e.expression,...e.bounds.map(e=>e.set)];case`FunctionConstruction`:return[...e.bounds.map(e=>e.set),e.body];case`FunctionSet`:return[e.domain,e.range];case`Record`:case`RecordSet`:return e.fields.map(e=>e.value);case`Except`:return[e.function,...e.updates.flatMap(e=>[...e.path.flatMap(e=>e.kind===`Index`?e.args:[]),e.value])];case`FunctionApplication`:return[e.function,...e.args];case`FieldAccess`:return[e.record];case`Product`:return e.factors;case`BoxAction`:case`AngleAction`:return[e.action,e.subscript];case`WeakFairness`:case`StrongFairness`:return[e.subscript,e.action];case`Label`:return[e.body];case`Subexpression`:return e.selectors.flatMap(e=>`args`in e?e.args:[])}},H=e=>(e.kind===`Identifier`||e.kind===`Apply`)&&e.resolution?.kind===`Local`,Ln=(e,t)=>t.definitions.get(t.substitutions.get(e)??e),Rn=(e,t)=>{if(e.kind===`Prime`||e.kind===`Unchanged`||e.kind===`Enabled`)return!0;let n=e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0;if(n!==void 0){if(t.variableIndex.has(n)||t.builtins.get(n)?.isStateLevel)return!0;let e=Ln(n,t);if(e&&!t.constants.has(n)&&!zn(e,t))return!0}return In(e).some(e=>Rn(e,t))},zn=(e,t)=>{let n=t.constantLevels.get(e);if(n!==void 0)return n;t.constantLevels.set(e,!0);let r=!Rn(e.body,t)&&(e.kind===`Operator`||!e.bounds.some(e=>Rn(e.set,t)));return t.constantLevels.set(e,r),r},Bn=(e,t)=>{if(!M(e))throw new r(`TLC encountered a non-enumerable quantifier bound ${I(e)} at ${z(t)}`);return N(e).elements},Vn=(e,t,n)=>{let r=e.map(e=>Bn(W(e.set,t),e.set)),i=(t,a)=>t<0?n(a):r[t].some(n=>i(t-1,Fn(a,e[t].pattern,n)));return i(e.length-1,t.scope)},Hn=(e,t)=>{let n=e.map(e=>W(e.set,t));return n.length===1?n[0]:{kind:`ProductSet`,factors:n}},Un=(e,t,n)=>{if(e.length===1)return Fn(t,e[0].pattern,n);let r=Te(n)??[];return e.reduce((e,t,n)=>Fn(e,t.pattern,r[n]),t)},Wn=(e,t)=>{let n=/* @__PURE__ */ new Map,r={kind:`LazyFunction`,domain:e,apply:e=>{let i=Le(e),a=n.get(i);if(a!==void 0){for(let t=0;t<a.length;t+=2)if(ce(a[t],e))return a[t+1]}let o=t(e,r),s=n.get(i);return s===void 0?n.set(i,[e,o]):s.push(e,o),o}};return r},Gn=(e,t)=>Wn(Hn(e.bounds,t),(n,r)=>W(e.body,B(t,Un(e.bounds,Pn(void 0,e.name,r),n)))),Kn=(e,t)=>{let n=zn(e,t.environment),i=n?t.environment.definitionValues.get(e):void 0;if(i!==void 0)return i;if(e.kind===`Operator`&&e.params.length>0)throw new r(`Operator ${e.name} requires ${e.params.length} arguments`);let a=B(t,void 0),o=e.kind===`Function`?Gn(e,a):W(e.body,a);return n&&t.environment.definitionValues.set(e,o),o},qn=(e,t)=>{let n=e.state===t.state&&e.next===t.next;if(n&&e.cache!==void 0)return e.cache;let r=W(e.expression,B(t,e.scope));return n&&(e.cache=r),r},Jn=/* @__PURE__ */ new WeakMap,Yn=e=>{let t=Jn.get(e);if(t)return t;let n={kind:`Closure`,name:e.name,params:e.params,body:e.body,scope:void 0};return Jn.set(e,n),n},Xn=(e,t)=>{let n=t.substitutions.get(e);if(n!==void 0)return Xn(n,t);let r=t.definitions.get(e);return r?.kind===`Operator`?Yn(r):t.builtins.get(e)},Zn=/* @__PURE__ */ new WeakMap,Qn=(e,t)=>{if(H(e))return $n(e.operator,t);let n=Zn.get(e),r=n===void 0?Xn(e.operator,t.environment)??null:n;return n===void 0&&Zn.set(e,r),r??$n(e.operator,t)},$n=(e,t)=>{let n=Nn(t.scope,e);if(n?.kind===`Operator`)return n.operator;if(!n)return Xn(e,t.environment)},er=e=>e.kind===`Closure`?e.params.length:e.arity,tr=(e,t)=>{if(e.kind===`Lambda`)return{kind:`Closure`,name:`LAMBDA`,params:e.params.map(e=>({name:e,arity:0})),body:e.body,scope:t.scope};let n=e.kind===`OperatorReference`?e.operator:e.kind===`Identifier`?e.name:void 0,i=n===void 0?void 0:$n(n,t);if(!i)throw new r(`Expected an operator argument at ${z(e)}`);return i},nr=(e,t,n)=>{if(e.kind===`Builtin`)return e.evaluate(t,n);if(e.kind===`Operator`)return e.call(t);let r=e.params.reduce((e,n,r)=>Pn(e,n.name,t[r]),e.scope);return W(e.body,B(n,r))},rr=(e,t)=>e.kind===`Operator`?e:{kind:`Operator`,name:e.name,arity:er(e),call:n=>nr(e,n,t)},ir=(e,t)=>{if(e.kind===`Lambda`||e.kind===`OperatorReference`)return!0;if(e.kind!==`Identifier`)return!1;let n=$n(e.name,t);return n!==void 0&&er(n)>0},ar=(e,t)=>({kind:`Thunk`,expression:e,scope:t.scope,state:t.state,next:t.next,cache:void 0}),or=(e,t)=>{let n=t.variableIndex.get(e);if(n!==void 0)return{kind:`Variable`,index:n};let r=t.constants.get(e);if(r!==void 0)return{kind:`Value`,value:r};let i=t.substitutions.get(e);if(i!==void 0)return or(i,t);let a=t.definitions.get(e);if(a)return{kind:`Definition`,definition:a};let o=t.builtins.get(e);if(o&&o.arity===0&&!o.isStateLevel)return{kind:`Value`,value:o.evaluate([])}},sr=(e,t)=>{if(e.kind===`String`||e.kind===`Number`&&mr(e.value)){let t={kind:`Value`,value:e.value};return()=>t}if(e.kind===`Identifier`){let n=H(e)?void 0:or(e.name,t);if(n?.kind===`Value`){let e={kind:`Value`,value:n.value};return()=>e}if(n===void 0)return t=>{let n=Nn(t.scope,e.name);return n?.kind===`Value`?n:ar(e,t)}}return t=>ar(e,t)},cr=/* @__PURE__ */ new WeakMap,lr=(e,t)=>{let n=cr.get(e);if(n)return n;let r=sr(e,t);return cr.set(e,r),r},ur=(e,t,n)=>{if(t.length!==e.params.length)throw new r(`Operator ${e.name} expects ${e.params.length} arguments but received ${t.length}`);let i=e.scope;for(let r=0;r<t.length;r++){let a=e.params[r],o=a.arity>0?{kind:`Operator`,operator:tr(t[r],n)}:lr(t[r],n.environment)(n);i={name:a.name,binding:o,parent:i}}return i},dr=(e,t,n)=>e.kind===`Closure`?W(e.body,B(n,ur(e,t,n))):e.kind===`Operator`?e.call(t.map(e=>W(e,n))):e.isLazy?e.evaluate(Pr(t,n),n):e.evaluate(t.map(e=>ir(e,n)?rr(tr(e,n),n):W(e,n)),n),fr=(e,t)=>e.reduce((e,n)=>{let r={name:n.name,binding:{kind:`Value`,value:!1},parent:e};return n.kind===`Function`?(r.binding={kind:`Thunk`,expression:{kind:`FunctionConstruction`,bounds:n.bounds,body:n.body,location:n.location,isRecursive:!0},scope:r,state:t.state,next:t.next,cache:void 0},r):n.params.length>0?(r.binding={kind:`Operator`,operator:{kind:`Closure`,name:n.name,params:n.params,body:n.body,scope:r}},r):(r.binding={kind:`Thunk`,expression:n.body,scope:r,state:t.state,next:t.next,cache:void 0},r)},t.scope),pr=(e,t,n)=>{let i=Nn(n.scope,e);if(i?.kind===`Value`)return i.value;if(i?.kind===`Thunk`)return qn(i,n);if(i?.kind===`Operator`){if(er(i.operator)===0)return nr(i.operator,[],n);throw new r(`Operator ${e} is used without arguments`)}let a=or(e,n.environment);if(a?.kind===`Variable`){let i=n.state?.[a.index];if(i===void 0)throw new r(`The variable ${e} is not assigned at ${z(t)}`);return i}if(a?.kind===`Value`)return a.value;if(a?.kind===`Definition`)return Kn(a.definition,n);let o=n.environment.builtins.get(e);if(o?.arity===0)return o.evaluate([],n);throw new r(`Unknown identifier ${e} at ${z(t)}`)},mr=e=>Number.isInteger(e)&&e<=2147483647&&e>=-2147483648,hr=/* @__PURE__ */ new Set([`Print`,`PrintT`,`Assert`,`JavaTime`,`RandomElement`,`TLCGet`,`TLCSet`]),gr=(e,t)=>hr.has(e)||t.builtins.get(e)?.isStateLevel===!0,_r=/* @__PURE__ */ new WeakMap,vr=(e,t)=>{let n=_r.get(e);if(n!==void 0)return n;let r=Sr(e,t,br);return _r.set(e,r),r},yr=/* @__PURE__ */ new Set([`Number`,`String`,`Identifier`,`Apply`,`And`,`Or`,`If`,`Case`,`SetEnumeration`,`Tuple`,`FunctionSet`,`Record`,`RecordSet`,`FunctionApplication`,`FieldAccess`,`Product`,`SetFilter`,`SetMap`,`Forall`,`Exists`,`Choose`,`FunctionConstruction`,`Let`]),br=/* @__PURE__ */ new Set,xr=(e,t,n)=>n.size===0?vr(e,t):Sr(e,t,n),Sr=(e,t,n)=>{if(!yr.has(e.kind))return!1;if(e.kind===`Identifier`&&H(e))return n.has(e.name);if(H(e))return!1;if(e.kind===`Identifier`){let n=or(e.name,t);return n?.kind===`Value`||n?.kind===`Definition`&&n.definition.kind===`Operator`&&n.definition.params.length===0&&zn(n.definition,t)}if(e.kind===`Apply`){if(gr(e.operator,t)||e.operator===`~>`)return!1;let r=Xn(e.operator,t);return!(r?.kind===`Builtin`||r?.kind===`Closure`&&(()=>{let n=t.definitions.get(t.substitutions.get(e.operator)??e.operator);return n!==void 0&&zn(n,t)})())||r===void 0||(r.kind===`Closure`?r.params:[]).some(e=>e.arity>0)?!1:e.args.every(e=>e.kind!==`Lambda`&&e.kind!==`OperatorReference`&&xr(e,t,n))}let r={value:!0};return Nt(e,(e,i)=>(r.value&&=xr(e,t,i.length===0?n:/* @__PURE__ */ new Set([...n,...i])),e)),r.value},Cr=e=>e.kind!==`Number`&&e.kind!==`String`&&e.kind!==`Identifier`,wr=e=>{let t={value:void 0};return n=>{if(t.value!==void 0)return t.value;let r=e(n);return t.value=r,r}},Tr=(e,t)=>{if(e.kind===`Identifier`&&H(e))return!t.has(e.name);if(H(e))return!0;let n={value:!1};return Nt(e,(e,r)=>(n.value||=Tr(e,r.length===0?t:/* @__PURE__ */ new Set([...t,...r])),e)),n.value},Er=(e,t)=>kt.has(e)&&Cr(e)&&Xr(e,t)!==void 0&&!Tr(e,br),U=(e,t)=>{let n=t.evaluators.get(e);if(n)return n;let r=qr(e,t),i=Cr(e)&&vr(e,t)?wr(r):Er(e,t)?jr(r):r;return t.evaluators.set(e,i),i},Dr=/* @__PURE__ */ new WeakMap,Or=(e,t)=>{let n=Dr.get(e);if(n)return n;let r=(Cr(e)&&vr(e,t)?void 0:st(e,t))??U(e,t);return Dr.set(e,r),r},W=(e,t)=>Or(e,t.environment)(t),kr=(e,t)=>{let n=e.name,i=H(e)?void 0:or(n,t);if(i?.kind===`Variable`){let t=i.index;return i=>{let a=i.state?.[t];if(a===void 0)throw new r(`The variable ${n} is not assigned at ${z(e)}`);return a}}if(i?.kind===`Value`){let e=i.value;return()=>e}if(i?.kind===`Definition`&&i.definition.kind===`Operator`){let e=i.definition;if(e.params.length===0&&zn(e,t))return t=>Kn(e,t);if(e.params.length===0){let n={body:void 0},r=r=>(n.body??=Or(e.body,t),n.body(B(r,void 0)));return Ar(e,t)?jr(r):r}return t=>Kn(e,t)}if(i?.kind===`Definition`){let e=i.definition,n=t=>Kn(e,t);return zn(e,t)||!Ar(e,t)?n:jr(n)}return t=>pr(n,e,t)},Ar=(e,t)=>Xr(e.body,t)!==void 0&&(e.kind===`Operator`||e.bounds.every(e=>Xr(e.set,t)!==void 0)),jr=e=>{let t={recent:void 0,recentValue:void 0,previous:void 0,previousValue:void 0};return n=>{let r=n.state;if(r!==void 0&&t.recent===r&&t.recentValue!==void 0)return t.recentValue;if(r!==void 0&&t.previous===r&&t.previousValue!==void 0)return t.previousValue;let i=e(n);return t.previous=t.recent,t.previousValue=t.recentValue,t.recent=r,t.recentValue=i,i}},Mr=(e,t)=>{let n=Xn(e,t);return n!==void 0&&er(n)>0},Nr=(e,t)=>e.kind!==`Lambda`&&e.kind!==`OperatorReference`&&!(e.kind===`Identifier`&&!H(e)&&Mr(e.name,t)),Pr=(e,t)=>e.map(e=>({kind:`Operator`,name:`argument`,arity:0,call:()=>W(e,t),expression:e})),Fr=(e,t,n)=>{if(e.isLazy)return n=>e.evaluate(Pr(t,n),n);let r=e.evaluateUnary;if(r&&t.length===1&&Nr(t[0],n)){let e=U(t[0],n);return t=>r(e(t))}let i=e.evaluateBinary,a=t.length===2&&Nr(t[0],n)&&Nr(t[1],n);if(i&&a){let e=U(t[0],n),r=U(t[1],n);return t=>i(e(t),r(t))}return n=>e.evaluate(t.map(e=>ir(e,n)?rr(tr(e,n),n):W(e,n)),n)},Ir=(e,t,n)=>{if(t.length!==e.params.length)return()=>{throw new r(`Operator ${e.name} expects ${e.params.length} arguments but received ${t.length}`)};let i=e.params,a=t.map((e,t)=>i[t].arity>0?void 0:lr(e,n));return n=>{let r=e.scope;for(let e=0;e<t.length;e++){let o=a[e],s=o?o(n):{kind:`Operator`,operator:tr(t[e],n)};r={name:i[e].name,binding:s,parent:r}}return r}},Lr=(e,t,n)=>{let r=Ir(e,t,n),i={body:void 0};return t=>{let a=r(t);return i.body??=Or(e.body,n),i.body({environment:n,scope:a,state:t.state,next:t.next})}},Rr=(e,t)=>{let n=e.args;if(e.operator===`=>`){let e=U(n[0],t),r=U(n[1],t);return t=>!V(e(t),`the left side of =>`)||V(r(t),`the right side of =>`)}if(e.operator===`~>`)return()=>{throw new r(`TLC cannot evaluate a temporal formula such as ~> in a state`)};let i=H(e)?void 0:Xn(e.operator,t);return i?.kind===`Closure`?Lr(i,n,t):i?.kind===`Builtin`?Fr(i,n,t):i=>{let a=$n(e.operator,i);if(a)return dr(a,n,i);throw t.definitions.get(e.operator)?.kind===`Function`?new r(`${e.operator} is a function; apply it with brackets`):new r(`Unknown operator ${e.operator} at ${z(e)}`)}},zr=(e,t)=>{let n=e.kind===`Forall`,r=n?`the body of \\A`:`the body of \\E`,i=U(e.body,t),a=e.bounds[0];if(e.bounds.length===1&&a.pattern.kind===`Name`){let e=a.pattern.name,o=U(a.set,t);return t=>{let s=Bn(o(t),a.set);for(let a=0;a<s.length;a++){let o=V(i(B(t,Pn(t.scope,e,s[a]))),r);if(o!==n)return o}return n}}let o=e.bounds;if(o.every(e=>e.pattern.kind===`Name`)){let e=o.map(e=>e.pattern.kind===`Name`?e.pattern.name:``),a=o.map(e=>U(e.set,t));return t=>{let s=a.map((e,n)=>Bn(e(t),o[n].set)),c=(a,o)=>{if(a<0)return V(i(B(t,o)),r)!==n;let l=s[a];for(let t=0;t<l.length;t++)if(c(a-1,Pn(o,e[a],l[t])))return!0;return!1};return c(o.length-1,t.scope)?!n:n}}return e=>Vn(o,e,t=>V(i(B(e,t)),r)!==n)?!n:n},Br=(e,t)=>{if(e.kind===`Tuple`)return j(e.names.map(e=>{let n=Nn(t,e);return n?.kind===`Value`&&n.value}));let n=Nn(t,e.name);return n?.kind===`Value`?n.value:void 0},Vr=(e,t)=>{let n=U(e.body,t),r=e.bounds,i=r[0],a=r.length===1&&i.pattern.kind===`Name`,o=U(i.set,t);return t=>{let s=a?o(t):Hn(r,t);if(e.isRecursive||!M(s))return Wn(s,e=>n(B(t,Un(r,t.scope,e))));if(a&&i.pattern.kind===`Name`){let e=i.pattern.name,r=N(s).elements;return O(r,r.map(r=>n(B(t,Pn(t.scope,e,r)))))}let c=[];return Vn(r,t,e=>{let a=r.length===1?Br(i.pattern,e)??!1:j(r.map(t=>Br(t.pattern,e)??!1));return c.push([a,n(B(t,e))]),!1}),pe(c)}},Hr=(e,t)=>{let n=U(e.function,t),r=e.updates.map(e=>({path:e.path.map(e=>e.kind===`Field`?{kind:`Field`,name:e.name,args:[]}:{kind:`Index`,name:``,args:e.args.map(e=>U(e,t))}),value:U(e.value,t)})),i=(e,t)=>e.kind===`Field`?e.name:e.args.length===1?e.args[0](t):j(e.args.map(e=>e(t))),a=(e,t,n,r,o)=>n===t.length?o(B(r,Pn(r.scope,`@`,e))):ke(e,i(t[n],r),e=>a(e,t,n+1,r,o));return e=>{let t=n(e);for(let n of r)t=a(t,n.path,0,e,n.value);return t}},Ur=(e,t)=>{if(e.kind===`SetFilter`){let n=U(e.predicate,t),i=U(e.bound.set,t),a=e.bound.pattern;return t=>{let o=i(t),s=e=>V(n(B(t,Fn(t.scope,a,e))),`a set filter predicate`);if(typeof o!=`object`||o.kind!==`Set`&&o.kind!==`Interval`){if(x(o))return{kind:`FilteredSet`,base:o,test:s};throw new r(`TLC encountered a non-enumerable quantifier bound ${I(o)} at ${z(e.bound.set)}`)}return D(N(o).elements.filter(s))}}if(e.kind===`SetMap`){let n=U(e.expression,t);return t=>{let r=[];return Vn(e.bounds,t,e=>(r.push(n(B(t,e))),!1)),A(r)}}let n=e.set;if(!n)return()=>{throw new r(`TLC cannot evaluate an unbounded CHOOSE at ${z(e)}`)};let i=U(e.body,t),a={pattern:e.pattern,set:n};return t=>{let n={value:void 0};if(Vn([a],t,r=>V(i(B(t,r)),`the body of CHOOSE`)?(n.value=Br(e.pattern,r),!0):!1),n.value===void 0)throw new r(`Attempted to compute CHOOSE x \\in S : P, but no element of S satisfies P at ${z(e)}`);return n.value}},Wr=(e,t)=>{let n=[...e].sort((e,t)=>e.name<t.name?-1:1),r=n.some((e,t)=>t>0&&n[t-1].name===e.name),i=n.map(e=>U(e.value,t));if(r)return e=>pe(n.map((t,n)=>[t.name,i[n](e)]));let a=n.map(e=>e.name);return e=>O(a,i.map(t=>t(e)))},Gr=(e,t)=>({kind:`Unchanged`,expression:e,location:t}),Kr=e=>()=>{throw e()},qr=(e,t)=>{let n=e=>U(e,t);switch(e.kind){case`Number`:{let t=e.value;return mr(t)?()=>t:()=>te(t)}case`String`:{let t=e.value;return()=>t}case`Identifier`:return kr(e,t);case`Apply`:return Rr(e,t);case`OperatorReference`:case`Lambda`:return Kr(()=>new r(`An operator cannot be used as a value at ${z(e)}`));case`And`:{let t=e.operands.map(n);return e=>{for(let n=0;n<t.length;n++)if(!V(t[n](e),`a conjunct`))return!1;return!0}}case`Or`:{let t=e.operands.map(n);return e=>{for(let n=0;n<t.length;n++)if(V(t[n](e),`a disjunct`))return!0;return!1}}case`Prime`:{let t=n(e.expression);return n=>{if(!n.next)throw new r(`A primed expression appears outside an action at ${z(e)}`);return t({environment:n.environment,scope:n.scope,state:n.next,next:void 0})}}case`Unchanged`:{let t=n({kind:`Prime`,expression:e.expression,location:e.location}),r=n(e.expression);return e=>k(t(e),r(e))}case`If`:{let t=n(e.condition),r=n(e.consequent),i=n(e.alternative);return e=>V(t(e),`an IF condition`)?r(e):i(e)}case`Case`:{let t=e.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),i=e.other?n(e.other):void 0;return n=>{for(let e of t)if(V(e.condition(n),`a CASE guard`))return e.body(n);if(i)return i(n);throw new r(`No CASE guard is true at ${z(e)}`)}}case`Let`:{let t=n(e.body);return n=>t(B(n,fr(e.definitions,n)))}case`Forall`:case`Exists`:return zr(e,t);case`UnboundedQuantifier`:return Kr(()=>new r(`TLC cannot evaluate an unbounded quantifier at ${z(e)}`));case`Choose`:case`SetFilter`:case`SetMap`:return Ur(e,t);case`SetEnumeration`:{let t=e.elements.map(n);return e=>A(t.map(t=>t(e)))}case`Tuple`:{let t=e.elements.map(n);return e=>j(t.map(t=>t(e)))}case`FunctionConstruction`:return Vr(e,t);case`FunctionSet`:{let t=n(e.domain),r=n(e.range);return e=>({kind:`FunctionSet`,domain:t(e),range:r(e)})}case`Record`:return Wr(e.fields,t);case`RecordSet`:{let t=[...e.fields].sort((e,t)=>e.name<t.name?-1:1),r=t.map(e=>e.name),i=t.map(e=>n(e.value));return e=>({kind:`RecordSet`,names:r,sets:i.map(t=>t(e))})}case`Except`:return Hr(e,t);case`ExceptAt`:return t=>{let n=Nn(t.scope,`@`);if(n?.kind!==`Value`)throw new r(`@ appears outside an EXCEPT at ${z(e)}`);return n.value};case`FunctionApplication`:{let t=n(e.function),r=e.args.map(n);if(r.length===1){let e=r[0];return n=>De(t(n),e(n))}return e=>De(t(e),j(r.map(t=>t(e))))}case`FieldAccess`:{let t=n(e.record),r=e.field;return e=>De(t(e),r)}case`Product`:{let t=e.factors.map(n);return e=>({kind:`ProductSet`,factors:t.map(t=>t(e))})}case`BoxAction`:case`AngleAction`:{let t=n(e.action),r=n(Gr(e.subscript,e.location)),i=e.kind===`BoxAction`;return e=>i?V(t(e),`an action`)||r(e):V(t(e),`an action`)&&!r(e)}case`Enabled`:{let t=e.expression;return e=>An(t,e)}case`Label`:return n(e.body);case`Subexpression`:return Kr(()=>new r(`The subexpression reference at ${z(e)} does not name a subexpression`));case`Always`:case`Eventually`:case`WeakFairness`:case`StrongFairness`:return Kr(()=>new r(`TLC cannot evaluate a temporal formula in a state at ${z(e)}`))}},Jr=/* @__PURE__ */ new Set([`Prime`,`Unchanged`,`Enabled`,`Always`,`Eventually`,`BoxAction`,`AngleAction`,`WeakFairness`,`StrongFairness`]),Yr=e=>{if(e.kind===`Identifier`)return e.name;if(e.kind===`Apply`||e.kind===`OperatorReference`)return e.operator},Xr=(e,t)=>{let n=/* @__PURE__ */ new Set,r=/* @__PURE__ */ new Set,i=e=>{if(Jr.has(e.kind))return!1;let a=Yr(e),o=(e.kind===`Identifier`||e.kind===`Apply`)&&e.resolution?.kind===`Local`;if(a!==void 0&&!o&&!t.constants.has(a)){let e=t.substitutions.get(a)??a,o=t.definitions.get(e);if(!o&&gr(e,t))return!1;let s=t.variableIndex.get(a);if(s!==void 0&&n.add(s),o&&!r.has(o)&&(r.add(o),!i(o.body)||o.kind!==`Operator`&&!o.bounds.every(e=>i(e.set))))return!1}return In(e).every(i)};return i(e)?[...n]:void 0},Zr=/* @__PURE__ */ new Map([[`Reals`,`---- MODULE Reals ----
+const e={success:0,assumptionViolation:10,deadlock:11,safetyViolation:12,livenessViolation:13,assertViolation:14,specEvaluationFailure:75,safetyEvaluationFailure:76,livenessEvaluationFailure:77,specParseError:150,configParseError:151,error:255},t=/* @__PURE__ */ new WeakMap,n=/* @__PURE__ */ new WeakMap,r={isNextState:!1},i=e=>{r.isNextState=e},a=(e,n)=>(e instanceof Error&&!t.has(e)&&t.set(e,n),e),o=(e,t)=>{r.isNextState&&n.set(e,t)},s=e=>t.get(e)??n.get(e),c=t=>{try{let n=t();return n&&{addInitialState:(t,r)=>{try{n.addInitialState(t,r)}catch(t){throw a(t,e.error)}},addState:(t,r,i)=>{try{return n.addState(t,r,i)}catch(t){throw a(t,e.error)}},findViolation:()=>{try{return n.findViolation()}catch(t){throw a(t,e.error)}}}}catch(t){throw a(t,e.error)}};var l=class extends Error{constructor(e,t){super(e,{cause:t}),this.name=`TlaError`}},u=class extends l{constructor(e,t){super(e,t),this.name=`TlaSyntaxError`}},d=class extends l{constructor(e,t){super(e,t),this.name=`TlaConfigError`}},f=class extends l{constructor(e,t){super(e,t),this.name=`TlaEvaluationError`}},p=class extends f{constructor(t,n=e.error){super(t),this.name=`TlaEvaluationError`,o(this,n)}},m=class extends l{constructor(e,t){super(e,t),this.name=`TlaUnsupportedError`}};const h=t=>s(t)??(t instanceof u?e.specParseError:t instanceof d?e.configParseError:t instanceof f?e.specEvaluationFailure:e.error),g=/* @__PURE__ */ new Set(/* @__PURE__ */ `ACTION.ACTIONS.ASSUME.ASSUMPTION.AXIOM.BY.CASE.CHOOSE.CONSTANT.CONSTANTS.COROLLARY.DEF.DEFINE.DEFS.DOMAIN.ELSE.ENABLED.EXCEPT.EXTENDS.HAVE.HIDE.IF.IN.INSTANCE.LAMBDA.LEMMA.LET.LOCAL.MODULE.NEW.OBVIOUS.OMITTED.ONLY.OTHER.PICK.PROOF.PROPOSITION.PROVE.QED.RECURSIVE.STATE.SUBSET.SUFFICES.TAKE.TEMPORAL.TEMPORALS.THEN.THEOREM.UNCHANGED.UNION.USE.VARIABLE.VARIABLES.WITH.WITNESS`.split(`.`)),_=/* @__PURE__ */ new Map([[`in`,`\\in`],[`notin`,`\\notin`],[`subseteq`,`\\subseteq`],[`subset`,`\\subset`],[`supseteq`,`\\supseteq`],[`supset`,`\\supset`],[`cup`,`\\cup`],[`union`,`\\cup`],[`cap`,`\\cap`],[`intersect`,`\\cap`],[`X`,`\\X`],[`times`,`\\X`],[`o`,`\\o`],[`circ`,`\\o`],[`div`,`\\div`],[`land`,`/\\`],[`lor`,`\\/`],[`lnot`,`~`],[`neg`,`~`],[`equiv`,`<=>`],[`leq`,`<=`],[`geq`,`>=`],[`A`,`\\A`],[`forall`,`\\A`],[`E`,`\\E`],[`exists`,`\\E`],[`AA`,`\\AA`],[`EE`,`\\EE`],[`cdot`,`\\cdot`],[`sqsubseteq`,`\\sqsubseteq`],[`sqsupseteq`,`\\sqsupseteq`],[`sqsubset`,`\\sqsubset`],[`sqsupset`,`\\sqsupset`],[`sqcap`,`\\sqcap`],[`sqcup`,`\\sqcup`],[`oplus`,`\\oplus`],[`ominus`,`\\ominus`],[`otimes`,`\\otimes`],[`oslash`,`\\oslash`],[`odot`,`\\odot`],[`uplus`,`\\uplus`],[`prec`,`\\prec`],[`preceq`,`\\preceq`],[`succ`,`\\succ`],[`succeq`,`\\succeq`],[`sim`,`\\sim`],[`simeq`,`\\simeq`],[`approx`,`\\approx`],[`cong`,`\\cong`],[`asymp`,`\\asymp`],[`doteq`,`\\doteq`],[`propto`,`\\propto`],[`wr`,`\\wr`],[`star`,`\\star`],[`bullet`,`\\bullet`],[`bigcirc`,`\\bigcirc`],[`ll`,`\\ll`],[`gg`,`\\gg`]]),v=/* @__PURE__ */ new Map([[`/=`,`#`],[`=<`,`<=`],[`(+)`,`\\oplus`],[`(-)`,`\\ominus`],[`(.)`,`\\odot`],[`(/)`,`\\oslash`],[`(\\X)`,`\\otimes`]]),y=/* @__PURE__ */ `-+-> (\\X) <=> |-> ... ::= >>_ (+) (-) (.) (/) == => =< =| << <= <> <- >> >= /\\ \\/ /= [] ]_ |- |= || -> -| ~> .. :: := :> <: @@ ++ -- -. ** // ^^ ^+ ^* ^# %% ## && $$ ?? !! = < > / [ ] ( ) { } | - ~ . : @ , ' ! # % + * ^ & $ ?`.split(` `),b=/* @__PURE__ */ new Map([[`∧`,`/\\`],[`∨`,`\\/`],[`¬`,`~`],[`⇒`,`=>`],[`⟹`,`=>`],[`≡`,`<=>`],[`⇔`,`<=>`],[`∈`,`\\in`],[`∉`,`\\notin`],[`⊆`,`\\subseteq`],[`⊂`,`\\subset`],[`⊇`,`\\supseteq`],[`⊃`,`\\supset`],[`∪`,`\\cup`],[`∩`,`\\cap`],[`×`,`\\X`],[`∀`,`\\A`],[`∃`,`\\E`],[`≠`,`#`],[`≤`,`<=`],[`≥`,`>=`],[`↦`,`|->`],[`→`,`->`],[`⟨`,`<<`],[`⟩`,`>>`],[`□`,`[]`],[`◇`,`<>`],[`≜`,`==`],[`′`,`'`],[`∘`,`\\o`],[`⋅`,`\\cdot`]]),x=/^\\([bB][01]+|[oO][0-7]+|[hH][0-9a-fA-F]+)/,S=/* @__PURE__ */ new Map([[`b`,2],[`o`,8],[`h`,16]]),ee=e=>e.startsWith(`\\`)?parseInt(e.slice(2),S.get(e[1].toLowerCase())):Number(e),C=/-{4,}[ \t]*MODULE\b/,w=e=>/[A-Za-z0-9_]/.test(e),T=(e,t)=>{let n=e[t];if(n===`\\`&&/[A-Za-z]/.test(e[t+1]??``)){let n=/^[A-Za-z]+/.exec(e.slice(t+1))?.[0]??``,r={value:n.length};for(;r.value>0&&!_.has(n.slice(0,r.value));)r.value--;let i=_.get(n.slice(0,r.value));return{text:i??`\\`,length:i===void 0?1:r.value+1}}let r=b.get(n);if(r)return{text:r,length:n.length};let i=y.find(n=>e.startsWith(n,t));return i?{text:v.get(i)??i,length:i.length}:n===`\\`?{text:`\\`,length:1}:void 0},te=e=>e!==void 0&&e>=`0`&&e<=`9`,E=(e,t,n)=>{let r={value:t};for(;r.value<e.length&&n(e[r.value]);)r.value++;return r.value},ne=(e,t)=>{if(e[t]!==`<`)return 0;let n=e[t+1]===`+`||e[t+1]===`*`?t+2:E(e,t+1,te);if(n===t+1||e[n]!==`>`)return 0;let r=E(e,n+1,w),i=r===n+1&&(e[r]===`*`||e[r]===`-`);return E(e,i?r+1:r,e=>e===`.`)-t},re=(e,t)=>t===`	`?e+8-e%8:e+1,ie=e=>{let t=C.exec(e);if(!t)throw new u(`Expected a module header such as ---- MODULE Name ----`);let n=[],r=e.slice(0,t.index).split(`
+`),i={index:t.index,line:r.length,lineStart:t.index-r[r.length-1].length,moduleDepth:0},a={lineStart:-1,position:0,width:0},o=()=>{for((a.lineStart!==i.lineStart||a.position>i.index)&&(a.lineStart=i.lineStart,a.position=i.lineStart,a.width=0);a.position<i.index;a.position++)a.width=re(a.width,e[a.position]);return re(a.width,e[i.index])},s=(e,t,r)=>{let a=o();n.push({kind:e,text:t,line:i.line,column:a,endColumn:a+r-1}),i.index+=r},c=t=>{for(let n=0;n<t;n++)e[i.index]===`
+`&&(i.line++,i.lineStart=i.index+1),i.index++},l=e=>new u(`${e} at line ${i.line}, column ${o()}`);for(;i.index<e.length;){let t=e[i.index];if(t===`
+`||t===` `||t===`	`||t===`\r`){c(1);continue}if(e.startsWith(`\\*`,i.index)){let t=e.indexOf(`
+`,i.index);c((t===-1?e.length:t)-i.index);continue}if(e.startsWith(`(*`,i.index)){let t={value:0};do{if(i.index>=e.length)throw l(`Unterminated comment`);e.startsWith(`(*`,i.index)?(t.value++,c(2)):e.startsWith(`*)`,i.index)?(t.value--,c(2)):c(1)}while(t.value>0);continue}if(e.startsWith(`----`,i.index)){let t=E(e,i.index,e=>e===`-`)-i.index;e.slice(i.index+t).trimStart().startsWith(`MODULE`)&&i.moduleDepth++,s(`Separator`,`----`,t);continue}if(e.startsWith(`====`,i.index)){if(s(`ModuleEnd`,`====`,E(e,i.index,e=>e===`=`)-i.index),i.moduleDepth--,i.moduleDepth<=0)break;continue}if(t===`"`){let t=i.line,r=o(),a=[];for(c(1);e[i.index]!==`"`;){if(i.index>=e.length||e[i.index]===`
+`)throw l(`Unterminated string`);if(e[i.index]===`\\`){let t=e[i.index+1];a.push({n:`
+`,t:`	`,r:`\r`,f:`\f`}[t]??t),c(2)}else a.push(e[i.index]),c(1)}c(1),n.push({kind:`String`,text:a.join(``),line:t,column:r,endColumn:o()-1});continue}let r=x.exec(e.slice(i.index,i.index+64));if(r){s(`Number`,r[0],r[0].length);continue}if(w(t)){let t=e.slice(i.index,E(e,i.index,w));if(/^\d+$/.test(t)){let n=/^\d+(\.\d+)?/.exec(e.slice(i.index))?.[0]??t;s(n.includes(`.`)?`Decimal`:`Number`,n,n.length);continue}if(t.startsWith(`WF_`)||t.startsWith(`SF_`)){s(`Keyword`,t.slice(0,3),3);continue}s(g.has(t)?`Keyword`:`Identifier`,t,t.length);continue}let a=ne(e,i.index);if(a>0){s(`Step`,e.slice(i.index,i.index+a),a);continue}let u=T(e,i.index);if(u)s(`Operator`,u.text,u.length);else throw l(`Unexpected character ${JSON.stringify(t)}`)}let d=o();return n.push({kind:`End`,text:``,line:i.line,column:d,endColumn:d}),n},D=/* @__PURE__ */ new Set([`CONSTANT`,`CONSTANTS`,`INIT`,`NEXT`,`SPECIFICATION`,`INVARIANT`,`INVARIANTS`,`PROPERTY`,`PROPERTIES`,`CONSTRAINT`,`CONSTRAINTS`,`ACTION_CONSTRAINT`,`ACTION_CONSTRAINTS`,`SYMMETRY`,`VIEW`,`CHECK_DEADLOCK`,`ALIAS`,`POSTCONDITION`,`POSTCONDITIONS`,`_POSSIBLE`,`_PERIODIC`,`_RL_REWARD`]),ae=[`<-`,`<<`,`>>`,`=`,`{`,`}`,`,`,`[`,`]`,`(`,`)`],oe=e=>{let t=[],n={index:0,line:1};for(;n.index<e.length;){let r=e.slice(n.index),i=/^\s+/.exec(r)?.[0];if(i){n.line+=i.split(`
+`).length-1,n.index+=i.length;continue}if(r.startsWith(`\\*`)){let e=r.indexOf(`
+`);n.index+=e===-1?r.length:e;continue}if(r.startsWith(`(*`)){let e=r.indexOf(`*)`);if(e===-1)throw new d(`Unterminated comment at line ${n.line}`);n.line+=r.slice(0,e).split(`
+`).length-1,n.index+=e+2;continue}let a=/^\d+(?![A-Za-z_])/.exec(r)?.[0];if(a){t.push({kind:`Number`,text:a,line:n.line}),n.index+=a.length;continue}let o=/^[A-Za-z0-9_!]+/.exec(r)?.[0];if(o){t.push({kind:`Word`,text:o,line:n.line}),n.index+=o.length;continue}let s=/^"((?:[^"\\]|\\.)*)"/.exec(r);if(s){t.push({kind:`String`,text:s[1],line:n.line}),n.index+=s[0].length;continue}let c=ae.find(e=>r.startsWith(e));if(c){t.push({kind:`Symbol`,text:c,line:n.line}),n.index+=c.length;continue}let l=T(e,n.index);if(!l)throw new d(`Unexpected character ${JSON.stringify(r[0])} at line ${n.line}`);t.push({kind:`Word`,text:l.text,line:n.line}),n.index+=l.length}return t.push({kind:`End`,text:``,line:n.line}),t},se=e=>{let t=oe(e),n={index:0},r={init:void 0,next:void 0,specification:void 0,invariants:[],properties:[],constraints:[],actionConstraints:[],constants:[],substitutions:[],checkDeadlock:!0,symmetry:void 0,view:void 0,alias:void 0,postconditions:[],possible:[],periodic:void 0,rlReward:void 0},i={isSet:!1},a=()=>t[n.index],o=()=>t[n.index++],s=e=>e.kind===`Word`&&D.has(e.text),c=e=>{let t=o();if(t.text!==e)throw new d(`Expected ${JSON.stringify(e)} but found ${JSON.stringify(t.text)} at line ${t.line}`)},l=()=>{let e=o();if(e.kind!==`Word`||s(e))throw new d(`Expected a name but found ${JSON.stringify(e.text)} at line ${e.line}`);return e.text},u=()=>a().kind===`Word`&&!s(a()),f=()=>{let e=[];for(;u();)e.push(o().text);return e},p=(e,t)=>{if(r[e]!==void 0)throw new d(`The keyword ${t} appears twice`);r[e]=l()},m=()=>{let e=o();if(e.kind===`Number`)return{kind:`Number`,value:Number(e.text)};if(e.kind===`String`)return{kind:`String`,value:e.text};if(e.text===`TRUE`||e.text===`FALSE`)return{kind:`Boolean`,value:e.text===`TRUE`};if(e.text===`{`){let e=[];for(a().text!==`}`&&e.push(m());a().text===`,`;)o(),e.push(m());return c(`}`),{kind:`Set`,elements:e}}if(e.kind===`Word`&&!s(e))return{kind:`ModelValue`,name:e.text};throw new d(`Expected a value but found ${JSON.stringify(e.text)} at line ${e.line}`)},h=()=>{if(a().text!==`[`)return;o();let e=l();return c(`]`),e},g=()=>{for(;u();){let e=o().text;if(a().text===`(`){o();let t=[];for(;a().text!==`)`;)t.push(m()),a().text!==`)`&&c(`,`);o(),c(`=`);let n=h();r.constants.push({name:e,value:m(),args:t,...n&&{module:n}});continue}if(a().text===`<-`){o();let t=h();r.substitutions.push({name:e,target:l(),...t&&{module:t}});continue}c(`=`);let t=h();r.constants.push({name:e,value:m(),...t&&{module:t}})}};for(;a().kind!==`End`;){let e=o();switch(e.text){case`CONSTANT`:case`CONSTANTS`:g();break;case`INIT`:p(`init`,e.text);break;case`NEXT`:p(`next`,e.text);break;case`SPECIFICATION`:p(`specification`,e.text);break;case`SYMMETRY`:p(`symmetry`,e.text);break;case`VIEW`:p(`view`,e.text);break;case`INVARIANT`:case`INVARIANTS`:r.invariants.push(...f());break;case`PROPERTY`:case`PROPERTIES`:r.properties.push(...f());break;case`CONSTRAINT`:case`CONSTRAINTS`:r.constraints.push(...f());break;case`ACTION_CONSTRAINT`:case`ACTION_CONSTRAINTS`:r.actionConstraints.push(...f());break;case`ALIAS`:p(`alias`,e.text);break;case`POSTCONDITION`:case`POSTCONDITIONS`:r.postconditions.push(...f());break;case`_POSSIBLE`:r.possible.push(...f());break;case`_PERIODIC`:p(`periodic`,e.text);break;case`_RL_REWARD`:p(`rlReward`,e.text);break;case`CHECK_DEADLOCK`:{if(i.isSet)throw new d(`The keyword CHECK_DEADLOCK appears twice`);i.isSet=!0;let e=o().text;if(e!==`TRUE`&&e!==`FALSE`)throw new d(`CHECK_DEADLOCK expects TRUE or FALSE but found ${JSON.stringify(e)}`);r.checkDeadlock=e===`TRUE`;break}default:throw new d(`Unexpected ${JSON.stringify(e.text)} at line ${e.line}`)}}if(r.specification!==void 0&&(r.init!==void 0||r.next!==void 0))throw new d(`SPECIFICATION cannot be combined with INIT or NEXT`);return r},ce={Set:{open:`{ `,close:` }`,pad:`  `,separator:`,`,divider:``,dividerPad:``},Sequence:{open:`<< `,close:` >>`,pad:`   `,separator:`,`,divider:``,dividerPad:``},Subset:{open:`SUBSET `,close:` `,pad:` `,separator:`,`,divider:``,dividerPad:``},Function:{open:`( `,close:` )`,pad:`  `,separator:` @@`,divider:` :>`,dividerPad:`    `},Record:{open:`[ `,close:` ]`,pad:`  `,separator:`,`,divider:` |->`,dividerPad:`    `}},le=e=>{if(e===void 0)return!1;let t=e.charCodeAt(0);return t>=9&&t<=13||t>=28&&t<=32||t===5760||t>=8192&&t<=8202&&t!==8199||t===8232||t===8233||t===8287||t===12288},ue=e=>e!==void 0&&/^\p{Nd}$/u.test(e),de=e=>e!==void 0&&/^[\p{L}\p{Nd}]$/u.test(e),fe=e=>{let t=t=>{let n=E(e,t,le);return e[n]===void 0?void 0:n},n=(n,r,i,a,o,s)=>{let c={kind:n,first:r,last:r,children:[]},l={index:t(i)};for(;l.index!==void 0&&e[l.index]!==a;){let n=o(l.index);if(!n)return;c.children.push(n);let r=t(n.last+1);if(r===void 0)return;let i=e.startsWith(s,r)?r+s.length:r;l.index=t(i)}if(l.index!==void 0)return c.last=l.index,c},r=(n,r)=>{let i=o(n);if(!i)return;let a=t(i.last+1);if(a===void 0||!e.startsWith(r,a))return;let s=t(a+r.length),c=s===void 0?void 0:o(s);if(c)return{kind:`Pair`,first:n,last:c.last,children:[i,c]}},i=t=>{let n=E(e,t,ue);if(e.startsWith(`..`,n)&&ue(e[n+2]))return{kind:`Constant`,first:t,last:E(e,n+2,ue)-1,children:[]}},a=t=>{let n=e[t];if(n===`"`){let n=e.indexOf(`"`,t+1);return n===-1?void 0:{kind:`Constant`,first:t,last:n,children:[]}}let r=ue(n)?i(t):void 0;if(r)return r;if(n===`-`)return t+1>=e.length?void 0:{kind:`Constant`,first:t,last:E(e,t+1,ue)-1,children:[]};if(de(n))return{kind:`Constant`,first:t,last:E(e,t,de)-1,children:[]}},o=i=>{let s=t(i);if(s!==void 0)switch(e[s]){case`{`:return n(`Set`,s,s+1,`}`,o,`,`);case`<`:{let t=n(`Sequence`,s,s+2,`>`,o,`,`);return!t||t.last+1>=e.length?void 0:{...t,last:t.last+1}}case`[`:return n(`Record`,s,s+1,`]`,e=>r(e,`|->`),`,`);case`(`:return n(`Function`,s,s+1,`)`,e=>r(e,`:>`),`@@`);default:{if(!e.startsWith(`SUBSET`,s))return a(s);let n=t(s+6),r=n===void 0?void 0:o(n);return r?{kind:`Subset`,first:s,last:r.last,children:[r]}:void 0}}};return o(0)},pe=e=>{let t=e.length===0?void 0:fe(e);if(!t||t.last<e.length-1)return e;let n=t=>e.slice(t.first,t.last+1),r=e=>e.last-e.first+1,i=(e,t,i,s)=>{if(r(e)<=t-i||e.kind===`Constant`)return n(e);if(e.kind===`Pair`)return;let c=ce[e.kind],l=t-Math.max(c.open.length,c.pad.length),u=i+c.close.length,d=s+c.pad,f=e.kind===`Function`||e.kind===`Record`?o(e.children,l,u,d,c):a(e.children,l,u,d,c.separator);return f===void 0?void 0:c.open+f+c.close},a=(e,t,n,r,a)=>{let o=e.map((o,s)=>{let c=s===e.length-1,l=i(o,t,c?n:a.length,r);return l===void 0||c?l:`${l}${a}\n${r}`});return o.includes(void 0)?void 0:o.join(``)},o=(e,t,a,o,s)=>{let c=e.map((c,l)=>{let u=l===e.length-1,d=c.children[0],f=c.children[1],p=u?``:`${s.separator}\n${o}`,m=r(d)+s.divider.length+1+r(f);if(u?m<=t-a:m+s.separator.length<=t)return`${n(d)}${s.divider} ${n(f)}${p}`;let h=r(d)+s.divider.length<=t?n(d):i(d,t,a+s.divider.length,o),g=i(f,t-s.dividerPad.length,u?a:s.separator.length,o+s.dividerPad);return h===void 0||g===void 0?void 0:`${h}${s.divider}\n${o}${s.dividerPad}${g}${p}`});return c.includes(void 0)?void 0:c.join(``)};return i(t,80,0,``)??e},O=e=>typeof e==`object`&&e.kind!==`ModelValue`&&e.kind!==`Function`&&e.kind!==`LazyFunction`,k=e=>typeof e==`object`&&(e.kind===`Function`||e.kind===`LazyFunction`),A=e=>typeof e==`object`&&e.kind===`ModelValue`,me=e=>typeof e==`boolean`?`boolean`:typeof e==`number`?`integer`:typeof e==`string`?`string`:e.kind===`ModelValue`?`model value`:O(e)?`set`:`function`,he=e=>{if(!Number.isInteger(e)||e>2147483647||e<-2147483648)throw new p(`Integer overflow: ${e} is outside TLC's 32-bit range`);return e},ge={isUsed:!1},_e=(e,t)=>(ge.isUsed=!0,e.writtenKeys=t,e),j=e=>(e.writtenKeys??e.domain).map(t=>[t,e.range[Kt(e.domain,t)]]),ve=(e,t,n)=>_e(F(e,t),n),ye=e=>{if(!(typeof e!=`object`||e.kind!==`Function`&&e.kind!==`Set`)&&e.hash===0&&e.fingerprint===0){if(e.kind===`Set`)return e.elements.forEach(ye);e.writtenKeys=void 0,e.range.forEach(ye)}},be=e=>e.every(e=>typeof e==`string`),xe=(e,t)=>e.length>0&&t.length>0&&be(e)!==be(t),Se=(e,t)=>{ge.isUsed&&(e.writtenKeys=void 0,t.writtenKeys=void 0);let n=e.domain,r=t.domain;if(n.length!==r.length)return xe(n,r)?rt(e,t):n.length-r.length;if(n!==r)for(let e=0;e<n.length;e++){let t=P(n[e],r[e]);if(t!==0)return t}let i=e.range,a=t.range;if(i===a)return 0;for(let e=0;e<i.length;e++){let t=P(i[e],a[e]);if(t!==0)return t}return 0},Ce=(e,t)=>{let n=e.elements,r=t.elements;if(n.length!==r.length)return n.length-r.length;if(n===r)return 0;for(let e=0;e<n.length;e++){let t=P(n[e],r[e]);if(t!==0)return t}return 0},we=e=>A(e)&&e.name.length>2&&e.name[1]===`_`?e.name[0]:void 0,Te=(e,t,n)=>{let r=we(e),i=we(t);if(r===void 0&&i===void 0)return;let a=n?`check equality of`:`compare`;if(A(e)&&A(t)){if(r===void 0||i===void 0||r===i)return;throw new f(`Attempted to ${a} the differently-typed model values ${H(e)} and ${H(t)}`)}throw r===void 0?new f(`Attempted to ${a} the typed model value ${H(t)} and the non-model value\n${H(e)}`):new f(`Attempted to ${a}${n?``:` the`} typed model value ${H(e)} and non-model value\n${H(t)}`)},Ee={ranks:Object.create(null),size:0},De=e=>{Ee.ranks=Object.create(null),Ee.size=0;for(let t of e)M(t)},M=e=>(Ee.ranks[e]===void 0&&(Ee.ranks[e]=Ee.size++),e),Oe=()=>Ee.size,ke=e=>Ee.ranks[M(e)],Ae=(e,t)=>{if(e===t)return 0;let n=Ee.ranks,r=n[e],i=n[t];return r!==void 0&&i!==void 0?r-i:r===void 0?i===void 0&&e<t?-1:1:-1},N=e=>typeof e==`object`&&(e.kind===`InfiniteSet`||e.kind===`SequenceSet`),je=(e,t)=>(N(e)||N(t))&&(typeof e!=`object`||e.kind!==`SequenceSet`||typeof t!=`object`||t.kind!==`SequenceSet`),Me=(e,t,n)=>{if(!N(e))throw new f(`Attempted to ${n} the set ${H(L(e)?R(e):e,!0)} with the value:\n${H(t,!0)}`);if(!N(t))throw new f(`Attempted to compare overridden value ${H(e,!0)} with non-overridden value:\n${H(t,!0)}`);let r=e.kind===`InfiniteSet`?e.name:void 0,i=t.kind===`InfiniteSet`?t.name:void 0;if(r!==void 0&&r===i)return 0;if(r===`Nat`&&i===`Int`||r===`Int`&&i===`Nat`)return r===`Nat`?-1:1;throw new f(`Attempted to compare ${H(e,!0)} with the value\n${H(t,!0)}`)},Ne={kind:`InfiniteSet`,name:`Any`},Pe=e=>{throw new f(`Attempted to compare ANY with the value\n${H(e)}`)},P=(e,t)=>{if(e===t)return ge.isUsed&&ye(e),e===Ne?Pe(e):0;if(typeof e==`object`&&typeof t==`object`){let n=e.kind,r=t.kind;if(n===`Function`&&r===`Function`)return Se(e,t);if(n===`Set`&&r===`Set`)return Ce(e,t);if(n===`Interval`&&r===`Interval`){let n=Math.max(0,e.high-e.low+1),r=Math.max(0,t.high-t.low+1);return n!==r||n===0?n-r:e.low-t.low}if(n===`ModelValue`||r===`ModelValue`)return Te(e,t,!1),n===`ModelValue`&&r===`ModelValue`?Ae(e.name,t.name):n===`ModelValue`?-1:1;if(e===Ne||t===Ne)return Pe(e===Ne?t:e);if(O(e)&&O(t)&&je(e,t))return Me(e,t,`compare`);let i=O(e);if(i!==O(t))throw new f(`Attempted to compare ${me(e)} ${H(e)} with ${me(t)} ${H(t)}`);return i?Ce(R(e),R(t)):Se(V(e),V(t))}if(typeof e==`number`&&typeof t==`number`)return e-t;if(typeof e==`string`&&typeof t==`string`)return Ae(e,t);if(typeof e==`boolean`&&typeof t==`boolean`)return e<t?-1:1;if(Te(e,t,!1),A(e))return-1;if(A(t))return 1;throw new f(`Attempted to compare ${me(e)} ${H(e)} with ${me(t)} ${H(t)}`)},Fe=/* @__PURE__ */ new Map,Ie=e=>{M(e);let t=Fe.get(e);if(t)return t;let n={kind:`ModelValue`,name:e};return Fe.set(e,n),n},Le=e=>({kind:`Set`,elements:e,hash:0,fingerprint:0}),F=(e,t)=>({kind:`Function`,domain:e,range:t,hash:0,fingerprint:0,writtenKeys:void 0}),Re=(e,t)=>{if(e===t)return ge.isUsed&&ye(e),e!==Ne||Pe(e);if(typeof e!=`object`||typeof t!=`object`)return typeof e!=typeof t&&((typeof e==`object`||typeof t==`object`)&&Te(e,t,!0),P(e,t)===0);if((e.kind===`Set`||e.kind===`Function`)&&(t.kind===`Set`||t.kind===`Function`)&&e.hash!==0&&t.hash!==0&&e.hash!==t.hash)return!1;if(e.kind===`Function`&&t.kind===`Function`)return Se(e,t)===0;if(e.kind===`Set`&&t.kind===`Set`)return Ce(e,t)===0;if(A(e)||A(t))return Te(e,t,!0),A(e)&&A(t)&&e.name===t.name;if(e.kind===`Subset`&&t.kind===`Subset`)return Re(e.base,t.base);if(e.kind===`FunctionSet`&&t.kind===`FunctionSet`){let n=z(e.domain),r=z(t.domain);if(n||r)return n===r;let i=z(e.range),a=z(t.range);return i||a?i===a:Re(e.domain,t.domain)&&Re(e.range,t.range)}if(e.kind===`RecordSet`&&t.kind===`RecordSet`){if(z(e))return z(t);if(z(t))return!1;let n=e=>e.names.map((t,n)=>[t,e.sets[n]]).sort((e,t)=>e[0]<t[0]?-1:1),r=n(t);return e.names.length===t.names.length&&n(e).every((e,t)=>e[0]===r[t][0]&&Re(e[1],r[t][1]))}if(e.kind===`ProductSet`&&t.kind===`ProductSet`)return z(e)?z(t):!z(t)&&e.factors.length===t.factors.length&&e.factors.every((e,n)=>Re(e,t.factors[n]));let n=O(e)&&O(t)&&!(L(e)&&L(t));if(n&&je(e,t))return Me(e,t,`check equality of`)===0;if(n){if(!N(e)){let n=R(e);if(!N(t))return Ce(n,R(t))===0}return yn(e)===yn(t)}return P(e,t)===0},ze=(e,t)=>e===t||e.length===t.length&&e.every((e,n)=>Be(e,t[n])),Be=(e,t)=>e===t?!0:typeof e!=`object`||typeof t!=`object`?!1:e.kind===`Set`&&t.kind===`Set`?(e.hash===0||t.hash===0||e.hash===t.hash)&&ze(e.elements,t.elements):e.kind===`Function`&&t.kind===`Function`?(e.hash===0||t.hash===0||e.hash===t.hash)&&ze(e.domain,t.domain)&&ze(e.range,t.range):yn(e)===yn(t),Ve=e=>{let t=e.length===0?1:e[0];return typeof t==`number`&&e.every((e,n)=>e===t+n)?t:void 0},He=e=>{if(!k(e))return;let t=V(e);return{domain:t.domain,range:t.range,low:Ve(t.domain)}},Ue=e=>{if(!k(e))return;let t=V(e);return t.domain.every(e=>typeof e==`string`)?t:void 0},We=(e,t)=>{if(we(e)!==void 0)throw new f(`Attempted to compare the typed model value ${H(e)} and the non-model value\n${H(t)}`);return 1},Ge=(e,t)=>{if(we(e)!==void 0)throw new f(`Attempted to check equality of the typed model value ${H(e)} and the non-model value\n${H(t)}`);return!1},Ke=(e,t)=>{let n=we(e);if(n===void 0)return A(t)?Ae(e.name,t.name):-1;if(!A(t))throw new f(`Attempted to compare the typed model value ${H(e)} and non-model value\n${H(t)}`);let r=we(t);if(r!==void 0&&r!==n)throw new f(`Attempted to compare the differently-typed model values ${H(e)} and ${H(t)}`);return Ae(e.name,t.name)},qe=(e,t)=>{let n=we(e);if(n===void 0)return A(t)&&e.name===t.name;if(!A(t))throw new f(`Attempted to check equality of typed model value ${H(e)} and non-model value\n${H(t)}`);let r=we(t);if(r!==void 0&&r!==n)throw new f(`Attempted to check equality of the differently-typed model values ${H(e)} and ${H(t)}`);return e.name===t.name},Je={number:{name:`integer`,other:`non-integer`,equality:`check equality of`},string:{name:`string`,other:`non-string`,equality:`check equality of`},boolean:{name:`boolean`,other:`non-boolean`,equality:`compare equality of`}},Ye=(e,t,n)=>{let r=Je[typeof e==`number`?`number`:typeof e==`string`?`string`:`boolean`];return`Attempted to ${n?r.equality:`compare`} ${r.name} ${H(e)} with ${r.other}:\n${H(t)}`},Xe=(e,t,n)=>{let r=He(n);if(!r){if(A(n))return We(n,t);throw new f(`Attempted to compare the function ${H(t)} with the value:\n${H(n)}`)}if(e.range.length!==r.range.length)return e.range.length-r.range.length;let i=()=>Ze(e.range,r.range);if(e.low!==void 0&&e.range.length===0)return 0;if(e.low!==void 0&&r.low!==void 0)return e.low===r.low?i():e.low-r.low;let a=e.low??r.low;if(a===void 0)return Ze(e.domain,r.domain)||i();let o=e.low===void 0?e.domain:r.domain;for(let t=0;t<o.length;t++){let n=o[t];if(typeof n!=`number`)throw new f(`Attempted to compare integer with non-integer${e.low===void 0?``:`:`}\n${H(n)}.`);let r=e.low===void 0?n-(a+t):a+t-n;if(r!==0)return r}return i()},Ze=(e,t)=>{for(let n=0;n<e.length;n++){let r=rt(e[n],t[n]);if(r!==0)return r}return 0},Qe=(e,t)=>{let n=V(e);if(e.kind===`Function`&&qt(n)!==void 0){let r=k(t)?qt(t):void 0;return r?n.range.length-r.length||Ze(n.range,r):Xe({...n,low:1},e,t)}if(e.kind===`Function`&&n.domain.every(e=>typeof e==`string`)){let r=Ue(t);if(!r){if(A(t))return We(t,e);throw new f(`Attempted to compare record:\n${H(e)}\nwith non-record\n${H(t)}`)}return n.domain.length-r.domain.length||Ze(n.domain,r.domain)||Ze(n.range,r.range)}return Xe({...n,low:Ve(n.domain)},e,t)},$e=e=>typeof e==`object`&&(e.kind===`Set`||e.kind===`MixedSet`),et=(e,t)=>N(e)||N(t)||typeof t==`object`&&e.kind===t.kind&&(e.kind===`Interval`||e.kind===`Subset`||e.kind===`FunctionSet`||e.kind===`RecordSet`||e.kind===`ProductSet`),tt=(e,t)=>{let n=$e(t)?t:R(t);return{elements:R(e).elements,otherElements:R(n).elements}},nt=(e,t)=>{if(et(e,t))return P(e,t);if(!$e(e))return nt(R(e),t);if(!O(t)){if(A(t))return We(t,e);throw new f(`Attempted to compare the set ${H(e)} with the value:\n${H(t)}`)}let n=tt(e,t);return n.elements.length-n.otherElements.length||Ze(n.elements,n.otherElements)},rt=(e,t)=>{if(typeof e!=`object`){if(typeof t==typeof e)return P(e,t);if(A(t))return We(t,e);throw new f(Ye(e,t,!1))}return e.kind===`ModelValue`?Ke(e,t):k(e)?Qe(e,t):nt(e,t)},it=(e,t)=>e.every((e,n)=>ct(e,t[n])),at=(e,t,n)=>{let r=He(n);if(!r){if(A(n))return Ge(n,t);throw new f(`Attempted to check equality of the function ${H(t)} with the value:\n${H(n)}`)}if(e.range.length!==r.range.length)return!1;if(e.low!==void 0&&r.low!==void 0)return(e.range.length===0||e.low===r.low)&&it(e.range,r.range);let i=e.low??r.low;return i===void 0?it(e.domain,r.domain)&&it(e.range,r.range):(e.low===void 0?e.domain:r.domain).every((e,t)=>{if(typeof e!=`number`)throw new f(`Attempted to compare an integer with non-integer:\n${H(e)}.`);return e===i+t})&&it(e.range,r.range)},ot=(e,t)=>{let n=V(e);if(e.kind===`Function`&&qt(n)!==void 0){let r=k(t)?qt(t):void 0;return r?n.range.length===r.length&&it(n.range,r):at({...n,low:1},e,t)}if(e.kind===`Function`&&n.domain.every(e=>typeof e==`string`)){let r=Ue(t);if(!r){if(A(t))return Ge(t,e);throw new f(`Attempted to check equality of record:\n${H(e)}\nwith non-record\n${H(t)}`)}return n.domain.length===r.domain.length&&it(n.domain,r.domain)&&it(n.range,r.range)}return at({...n,low:Ve(n.domain)},e,t)},st=(e,t)=>{if(et(e,t))return Re(e,t);if(!$e(e))return st(R(e),t);if(!O(t)){if(A(t))return Ge(t,e);throw new f(`Attempted to check equality of the set ${H(e)} with the value:\n${H(t)}`)}let n=tt(e,t);return n.elements.length===n.otherElements.length&&it(n.elements,n.otherElements)},ct=(e,t)=>{if(typeof e!=`object`){if(typeof t==typeof e)return e===t;if(A(t))return Ge(t,e);throw new f(Ye(e,t,!0))}return e.kind===`ModelValue`?qe(e,t):k(e)?ot(e,t):st(e,t)},lt=e=>{let t=[];for(let n of e){let e={low:0,high:t.length,comparison:1};for(;e.low<e.high;){let r=e.low+(e.high-e.low>>1);if(e.comparison=rt(n,t[r]),e.comparison===0)break;e.comparison<0?e.high=r:e.low=r+1}e.comparison!==0&&t.splice(e.low,0,n)}return t},ut=(e,t)=>t.some(t=>ct(t,e)),dt=(e,t)=>{try{return Re(e,t)}catch(n){if(!(n instanceof f))throw n;return ct(e,t)}},ft=e=>{for(let t=1;t<e.length;t++)if(P(e[t-1],e[t])>=0)return!1;return!0},pt=e=>{if(e.length<2||ft(e))return Le(e);let t=[...e].sort(P),n=[t[0]];for(let e=1;e<t.length;e++)P(n[n.length-1],t[e])!==0&&n.push(t[e]);return Le(n)},mt=e=>{try{return pt(e)}catch(t){if(!(t instanceof f))throw t;return{kind:`MixedSet`,elements:e}}},ht=Le([]),gt=(e,t)=>{if(e.elements.length===0||t.elements.length===0)return e;let n=e.elements,r=t.elements,i=[],a=0;for(let e=0;e<n.length;e++){let t=n[e];for(;a<r.length&&P(r[a],t)<0;)a++;a<r.length&&P(r[a],t)===0||i.push(t)}return i.length===n.length?e:Le(i)},_t=(e,t)=>{let n=e.elements,r=t.elements,i=[],a=0;for(let e=0;e<n.length;e++){let t=n[e];for(;a<r.length&&P(r[a],t)<0;)a++;a<r.length&&P(r[a],t)===0&&i.push(t)}return i.length===n.length?e:Le(i)},vt=(e,t)=>{if(e.elements.length===0)return t;if(t.elements.length===0)return e;let n=e.elements,r=t.elements,i=[],a=[],o=0,s=0;for(;o<n.length&&s<r.length;){let e=P(n[o],r[s]);e<0?i.push(n[o++]):e>0?(a.push(r[s]),i.push(r[s++])):(i.push(n[o++]),s++)}for(;o<n.length;)i.push(n[o++]);for(;s<r.length;)a.push(r[s]),i.push(r[s++]);if(a.length===0)return e;let c=Le(i);if(e.hash!==0){let t=e.hash;for(let e=0;e<a.length;e++)t=t+sn(a[e])|0;c.hash=t}if(e.fingerprint!==0){let t=e.fingerprint;for(let e=0;e<a.length;e++)t=t+mn(a[e])|0;c.fingerprint=t}return c},yt=e=>{let t=e.length<2?e:[...e].sort((e,t)=>P(e[0],t[0])),n=[],r=[];for(let e of t)n.length>0&&P(n[n.length-1],e[0])===0||(n.push(e[0]),r.push(e[1]));return F(n,r)},bt=e=>{let t=yt(e);return t.domain.length!==e.length||e.some(e=>typeof e[0]!=`string`)||e.every((e,n)=>e[0]===t.domain[n])?t:_e(t,e.map(e=>e[0]))},xt=[],St=[],Ct=/* @__PURE__ */ new WeakMap,wt=e=>{let t=xt[e];if(t)return t;let n=Array.from({length:e},(e,t)=>t+1);return xt[e]=n,n},Tt=e=>{if(Ut(e),e.low===1&&e.high>=1)return wt(e.high);let t=[];for(let n=e.low;n<=e.high;n++)t.push(n);return t},Et=e=>e.length>0&&(e===xt[e.length]||Ct.has(e)),Dt=e=>{let t=R(e).elements;return Et(t)&&(typeof e!=`object`||e.kind!==`Interval`)?[...t]:t},Ot=e=>{let t=St[e];if(t)return t;let n={kind:`Interval`,low:1,high:e};return St[e]=n,n},I=e=>F(wt(e.length),e),kt=e=>yt(e),At=e=>O(e)&&!N(e),jt=(e,t=!1)=>`UNION(${H(e.base,t)})`,Mt=e=>{if(!At(e.base))throw new f(`Attempted to enumerate the nonenumerable set:\n${jt(e)}`);return R(e.base).elements},Nt=(e,t,n)=>{if(At(e))return e;throw new f(t===0?`Attempted to enumerate UNION(s), but some element of s is nonenumerable.`:`Attempted to enumerate the nonenumerable set:\n${H(e)}\nwhen enumerating:\n${jt(n)}`)},L=e=>{if(typeof e!=`object`)return!1;switch(e.kind){case`Set`:case`MixedSet`:case`Interval`:return!0;case`InfiniteSet`:case`SequenceSet`:return!1;case`Subset`:case`FilteredSet`:return L(e.base);case`FunctionSet`:return L(e.domain)&&L(e.range)||Pt(e.domain)===!0||Pt(e)===!0;case`RecordSet`:return e.sets.every(L)||Pt(e)===!0;case`ProductSet`:return e.factors.every(L)||Pt(e)===!0;case`Union`:return L(e.base)&&R(e.base).elements.every(L);case`SetOperation`:return e.operator===`\\cup`?L(e.left)&&L(e.right):e.operator===`\\cap`?L(e.left)||L(e.right):L(e.left);default:return!1}},Pt=e=>{if(typeof e==`object`)switch(e.kind){case`Set`:case`MixedSet`:return e.elements.length===0;case`Interval`:return e.low>e.high;case`InfiniteSet`:return e.name===`Any`&&void 0;case`Subset`:case`SequenceSet`:return!1;case`FunctionSet`:{let t=Pt(e.domain);return t===void 0?void 0:!t&&Pt(e.range)}case`RecordSet`:case`ProductSet`:for(let t of e.kind===`RecordSet`?e.sets:e.factors){let e=Pt(t);if(e!==!1)return e}return!1;case`SetOperation`:case`FilteredSet`:case`Union`:return L(e)?R(e).elements.length===0:void 0;default:return}},Ft=e=>{let t=e.reduce((e,t)=>e*t.length,1),n=[],r=e.map(()=>0);for(let i=0;i<t;i++){n.push(e.map((e,t)=>e[r[t]]));for(let t=e.length-1;t>=0&&(r[t]++,!(r[t]<e[t].length));t--)r[t]=0}return n},It=(e,t)=>{for(let n=e.length-1;n>=0;n--)if(e[n]<t-e.length+n){e[n]++;for(let t=n+1;t<e.length;t++)e[t]=e[t-1]+1;return!0}return!1},Lt=e=>{let t=[];for(let n=0;n<=e.length;n++){let r=Array.from({length:n},(e,t)=>t);do t.push(Le(r.map(t=>e[t])));while(It(r,e.length))}return t},Rt=e=>{if(typeof e!=`object`)throw new f(`Expected a set but found ${H(e)}`);switch(e.kind){case`Set`:return e.elements;case`MixedSet`:return lt(e.elements);case`Interval`:{let t=Tt(e);return t!==xt[t.length]&&Ct.set(t,e),t}case`Subset`:{N(e.base)&&Ut(e.base);let t=R(e.base).elements;if(t.length>30)throw new f(`SUBSET of a set with ${t.length} elements is too large to enumerate`);return Lt(t)}case`FunctionSet`:{if(z(e))return[];if(N(e.domain))throw new f(`Attempted to enumerate a set of the form [D -> R],but the domain D:\n${H(e.domain)}\ncannot be enumerated.`);let t=Dt(e.domain);if(t.length>0&&N(e.range))throw new f(`Attempted to enumerate a set of the form [D -> R],but the range R:\n${H(e.range)}\ncannot be enumerated.`);let n=t.length===0?[]:R(e.range).elements;return Ft(t.map(()=>n)).map(e=>F(t,e))}case`RecordSet`:{if(z(e))return[];let t=e.sets.map((t,n)=>{if(N(t))throw new f(`Attempted to enumerate a set of the form [l1 : v1, ..., ln : vn],\nbut can't enumerate the value of the \`${e.names[n]}' field:\n${H(t)}`);return R(t).elements});return Ft(t).map(t=>kt(e.names.map((e,n)=>[e,t[n]])))}case`ProductSet`:{if(z(e))return[];let t=e.factors.map((e,t)=>{if(N(e))throw new f(`Attempted to enumerate a set of the form s1 \\X s2 ... \\X sn,\nbut can't enumerate s${t}:\n${H(e)}`);return R(e).elements});return Ft(t).map(I)}case`FilteredSet`:if(N(e.base))throw new f(`Attempted to enumerate { x \\in S : p(x) } when S:\n${H(e.base)}\nis not enumerable`);return R(e.base).elements.filter(e.test);case`Union`:{let t=Mt(e).flatMap((t,n)=>R(Nt(t,n,e)).elements);return R(mt(t)).elements}case`SetOperation`:{if(e.operator===`\\cup`&&(N(e.left)||N(e.right)))throw new f(`Attempted to enumerate S \\cup T when S:\n${H(e.left)}\nand T:\n${H(e.right)}\nare not both enumerable`);if(e.operator===`\\cap`&&N(e.left)&&N(e.right))throw new f(`Attempted to enumerate S \\cap T when neither S:\n${H(e.left)}\nnor T:\n${H(e.right)}\nis enumerable`);if(e.operator===`\\`&&N(e.left))throw new f(`Attempted to enumerate S \\ T when S:\n${H(e.left)}\nis not enumerable.`);if(e.operator===`\\cup`)return vt(R(e.left),R(e.right)).elements;let t=e.operator===`\\`||L(e.left),n=t?e.left:e.right,r=t?e.right:e.left;return R(n).elements.filter(t=>B(t,r)===(e.operator===`\\cap`))}case`InfiniteSet`:case`SequenceSet`:throw new f(`Attempted to enumerate the non-enumerable set ${H(e)}`);default:throw new f(`Expected a set but found ${H(e)}`)}},zt=/* @__PURE__ */ new WeakMap,R=e=>{if(typeof e==`object`&&e.kind===`Set`)return e;if(typeof e==`object`&&e.kind===`Interval`)return Le(Rt(e));let t=typeof e==`object`?zt.get(e):void 0;if(t)return t;let n=Rt(e),r=typeof e==`object`&&(e.kind===`MixedSet`||e.kind===`Union`||e.kind===`SetOperation`||e.kind===`FilteredSet`||e.kind===`ProductSet`||e.kind===`FunctionSet`||e.kind===`Subset`)?Le(n):pt(n);return typeof e==`object`&&zt.set(e,r),r},Bt=e=>{if(typeof e!=`object`||zt.has(e))return R(e).elements;if(e.kind===`Union`)return Mt(e).flatMap((t,n)=>Bt(Nt(t,n,e)));if(e.kind===`FilteredSet`&&!N(e.base))return Bt(e.base).filter(e.test);if(e.kind!==`SetOperation`)return R(e).elements;if(e.operator===`\\cup`)return N(e.left)||N(e.right)?R(e).elements:[...Bt(e.left),...Bt(e.right)];let t=e.operator===`\\`||L(e.left),n=t?e.left:e.right,r=t?e.right:e.left;return N(n)?R(e).elements:Bt(n).filter(t=>B(t,r)===(e.operator===`\\cap`))},z=e=>{if(typeof e!=`object`||!O(e))throw new f(`Shouldn't call isEmpty() on value ${H(e)}`);switch(e.kind){case`Set`:case`MixedSet`:return e.elements.length===0;case`Interval`:return e.low>e.high;case`InfiniteSet`:if(e.name===`Any`)throw new f(`Shouldn't call isEmpty() on value ANY`);return!1;case`Subset`:case`SequenceSet`:return!1;case`ProductSet`:return e.factors.some(z);case`RecordSet`:return e.sets.some(z);case`FunctionSet`:return!z(e.domain)&&z(e.range);case`Union`:return Mt(e).every((t,n)=>z(Nt(t,n,e)));default:return R(e).elements.length===0}},Vt=(e,t)=>e.reduce((e,n)=>{let r=e*Ut(n);if(r>2147483647)throw new f(t());return r},1),Ht=e=>`Overflow when computing the number of elements in:\n${H(e)}`,Ut=e=>{if(typeof e!=`object`)return R(e).elements.length;switch(e.kind){case`Interval`:{let t=Math.max(0,e.high-e.low+1);if(t>2147483647)throw new f(`Size of interval value exceeds the maximum representable size (32bits): ${e.low}..${e.high}.`);return t}case`InfiniteSet`:case`SequenceSet`:throw new f(`Attempted to compute the number of elements in the overridden value ${H(e)}.`);case`Subset`:{let t=Ut(e.base);if(t>=31)throw new f(Ht(e));return 2**t}case`FunctionSet`:{if(z(e.domain))return 1;if(z(e.range))return 0;let t=Ut(e.range);if(t===1)return 1;let n=Ut(e.domain),r={value:1};for(let i=0;i<n;i++)if(r.value*=t,r.value>2147483647)throw new f(Ht(e));return r.value}case`RecordSet`:return z(e)?0:Vt(e.sets,()=>Ht(e));case`ProductSet`:return z(e)?0:Vt(e.factors,()=>`Overflow when computing the number of elements in ${H(e)}`);default:return R(e).elements.length}},Wt=e=>`Attempted to check if the set ${H(e)}is finite.`,Gt=e=>{if(typeof e!=`object`||e.kind===`ModelValue`)throw new f(`Attempted to check if the ${me(e)} ${H(e)} is a finite set.`);switch(e.kind){case`Set`:case`MixedSet`:case`Interval`:case`Function`:return!0;case`LazyFunction`:throw new f(`Attempted to check if the function:\n${H(e)}\nis a finite set.`);case`InfiniteSet`:return!1;case`SequenceSet`:return Gt(e.base)&&z(e.base);case`Subset`:return Gt(e.base);case`FunctionSet`:{let t=Gt(e.domain);if(t&&z(e.domain))return!0;let n=Gt(e.range);return n&&z(e.range)?!0:n&&(t||Ut(e.range)===1)}case`RecordSet`:case`ProductSet`:{let t=e.kind===`RecordSet`?e.sets:e.factors,n={isAllFinite:!0};for(let e of t)if(!Gt(e))n.isAllFinite=!1;else if(z(e))return!0;return n.isAllFinite}case`Union`:if(!At(e.base))throw new f(`Attempted to check if the nonenumerable set:\n${jt(e)}\nis a finite set.`);return R(e.base).elements.every(Gt);case`SetOperation`:if(e.operator===`\\cup`)return Gt(e.left)&&Gt(e.right);if(e.operator===`\\cap`){if(!Gt(e.left)&&!Gt(e.right))throw new f(Wt(e));return!0}if(Gt(e.left))return!0;if(!Gt(e.right))throw new f(Wt(e));return!1;case`FilteredSet`:if(!Gt(e.base))throw new f(`Attempted to check if expression of form {x \\in S : p(x)} is a finite set, but cannot check if S:\n${H(e.base)}\nis finite.`);return!0}},Kt=(e,t)=>{let n={low:0,high:e.length-1};for(;n.low<=n.high;){let r=n.low+n.high>>1,i=P(e[r],t);if(i===0)return r;i<0?n.low=r+1:n.high=r-1}return-1},qt=e=>{if(typeof e!=`object`||!k(e))return;let t=V(e);return t.domain.every((e,t)=>e===t+1)?t.range:void 0},Jt=(e,t)=>`Attempted to check if the value ${H(e)} is an element of ${H(t)}`,Yt=(e,t)=>{let n=`Attempted to check if the value:\n${H(e)}\nis an element of the`;if(!k(t))return`${n} ${me(t)} ${H(t)}`;let r=t.kind===`Function`||L(t.domain)?V(t).domain:[];return r.length>0&&r.every(e=>typeof e==`string`)?`Attempted to check if element:\n${H(e)}\nis in the record:\n${H(t)}`:r.every((e,t)=>e===t+1)?`Attempted to check set membership in a tuple value.`:`${n} function ${H(t)}`},B=(e,t)=>{if(!O(t))throw new f(Yt(e,t));switch(t.kind){case`Set`:try{return Kt(t.elements,e)!==-1}catch(n){if(!(n instanceof f))throw n;return ut(e,t.elements)}case`MixedSet`:return ut(e,t.elements);case`Interval`:if(typeof e==`number`)return e>=t.low&&e<=t.high;if(t.low<=t.high&&!A(e))throw new f(`Attempted to check if the value:\n${H(e)}\nis in the integer interval ${H(t)}`);return!1;case`InfiniteSet`:if(t.name===`Any`)return!0;if(A(e))return!1;if(!(t.name===`STRING`?typeof e==`string`:typeof e==`number`))throw new f(`Attempted to check if the value:\n${H(e)}\nis an element of ${t.name}.`);return t.name!==`Nat`||typeof e==`number`&&e>=0;case`Subset`:if(!O(e))throw new f(Jt(e,t));return R(e).elements.every(e=>B(e,t.base));case`FunctionSet`:{if(!k(e)){if(A(e))return!1;throw new f(Jt(e,t))}let n=V(e),r=Ve(n.domain);return(r===void 0?dt(t.domain,Le(n.domain)):dt({kind:`Interval`,low:r,high:r+n.domain.length-1},t.domain))&&n.range.every(e=>B(e,t.range))}case`RecordSet`:{let n=k(e)?V(e):void 0;if(!n||!be(n.domain)){if(A(e))return!1;throw new f(`Attempted to check if non-record\n${H(e)}\nis in the set of records:\n${H(t)}`)}return n.domain.length===t.names.length&&t.names.every((e,r)=>{let i=Kt(n.domain,e);return i!==-1&&B(n.range[i],t.sets[r])})}case`ProductSet`:{let n=k(e)?qt(e):void 0;if(n===void 0){if(k(e)&&V(e).domain.every(e=>typeof e==`number`)||A(e))return!1;throw new f(`Attempted to check if non-tuple\n${H(e)}\nis in the set of tuples:\n${H(t)}`)}return n.length===t.factors.length&&n.every((e,n)=>B(e,t.factors[n]))}case`FilteredSet`:return B(e,t.base)&&t.test(e);case`Union`:if(!At(t.base))throw new f(`Attempted to check if:\n ${H(e)}\nis an element of the non-enumerable set:\n ${jt(t)}`);return R(t.base).elements.some(t=>B(e,t));case`SetOperation`:return t.operator===`\\cup`?B(e,t.left)||B(e,t.right):B(e,t.left)&&B(e,t.right)===(t.operator===`\\cap`);case`SequenceSet`:{let n=qt(e);if(n===void 0){if(A(e))return!1;throw new f(Jt(e,t))}return n.every(e=>B(e,t.base))}default:throw new f(Yt(e,t))}},V=e=>{if(typeof e==`object`&&e.kind===`Function`)return e;if(typeof e==`object`&&e.kind===`LazyFunction`){L(e.domain)||Ut(e.domain);let t=Dt(e.domain);return F(t,t.map(t=>e.apply(t)))}throw new f(`Expected a function but found ${H(e)}`)},Xt=/* @__PURE__ */ new WeakSet,Zt=e=>(Xt.add(e),e),Qt=(e,t)=>typeof e==`object`&&Xt.has(e)?`In applying the function\n${pe(H(e))},\nthe first argument is:\n${pe(H(t))}\nwhich is not in its domain.\n`:`Attempted to apply function ${H(e)} to ${H(t)}, which is not in its domain`,$t=(e,t,n)=>{if(typeof e==`object`&&e.kind===`LazyFunction`){if(!B(t,e.domain))throw new f(Xt.has(e)?Qt(e,t):`Attempted to apply a function to ${H(t)}, which is not in its domain`);return e.apply(t)}if(typeof e!=`object`||e.kind!==`Function`)throw new f(`Attempted to apply ${H(e)}, which is not a function`);let r=e.domain,i=r[0];if(typeof t==`number`&&typeof i==`number`){let n=t-i;if(r[n]===t)return e.range[n]}if(r.length<=8){for(let n=0;n<r.length;n++)if(r[n]===t)return e.range[n]}let a=Kt(r,t);if(a===-1)throw new f(n?.(e)??Qt(e,t));return e.range[a]},en=e=>{if(typeof e==`object`&&e.kind===`LazyFunction`)return e.domain;let t=V(e).domain;return Et(t)?Ct.get(t)??Ot(t.length):Le(t)},tn=(e,t,n,r=!1)=>{if(typeof e==`object`&&e.kind===`LazyFunction`&&(r||!L(e.domain))){if(!B(t,e.domain))return e;let r=n(e.apply(t));return{kind:`LazyFunction`,domain:e.domain,apply:n=>dt(t,n)?r:e.apply(n),source:e.source}}let i=V(e),a=Kt(i.domain,t);if(a===-1)return i;let o=[...i.range],s=i.range[a],c=n(s);o[a]=c;let l=F(i.domain,o);if(l.writtenKeys=i.writtenKeys,i.hash!==0){let e=i.domain[a];l.hash=s===c?i.hash:i.hash-cn(e,s)+cn(e,c)|0}if(i.fingerprint!==0){let e=i.domain[a];l.fingerprint=s===c?i.fingerprint:i.fingerprint-hn(e,s)+hn(e,c)|0}return l},nn=/* @__PURE__ */ new WeakMap,rn=e=>{let t=Math.imul(e^e>>>16,2246822507),n=Math.imul(t^t>>>13,3266489909);return n^n>>>16},an=(e,t)=>Math.imul(e^t,16777619),on=e=>{let t=2166136261;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),16777619);return rn(t)},sn=e=>rn(un(e)+2654435769|0),cn=(e,t)=>rn(Math.imul(un(e),668265261)+un(t)|0),ln=e=>{if(e.kind===`ModelValue`)return rn(an(on(e.name),109));if(O(e)){if(!L(e))return on(yn(e));let t=R(e).elements,n=1940243425;for(let e=0;e<t.length;e++)n=n+sn(t[e])|0;return n}let t=V(e),n=1725019383;for(let e=0;e<t.domain.length;e++)n=n+cn(t.domain[e],t.range[e])|0;return n},un=e=>{if(typeof e==`number`)return rn(e^1540483477);if(typeof e==`boolean`)return e?729683222:682545830;if(typeof e==`string`)return on(e);if(e.kind===`Set`||e.kind===`Function`)return e.hash===0&&(e.hash=ln(e)),e.hash;let t=nn.get(e);if(t!==void 0)return t;let n=ln(e);return nn.set(e,n),n},dn=/* @__PURE__ */ new WeakMap,fn=e=>{let t=Math.imul(e^e>>>15,739982445),n=Math.imul(t^t>>>12,695872825);return n^n>>>15},pn=e=>{let t=2538058380;for(let n=0;n<e.length;n++)t=Math.imul(t^e.charCodeAt(n),1540483477);return fn(t)},mn=e=>fn(_n(e)+2135587861|0),hn=(e,t)=>fn(Math.imul(_n(e),374761393)+_n(t)|0),gn=e=>{if(e.kind===`ModelValue`)return fn(pn(e.name)^60);if(O(e)){if(!L(e))return pn(yn(e));let t=R(e).elements,n=461845907;for(let e=0;e<t.length;e++)n=n+mn(t[e])|0;return n}let t=V(e),n=1291169091;for(let e=0;e<t.domain.length;e++)n=n+hn(t.domain[e],t.range[e])|0;return n},_n=e=>{if(typeof e==`number`)return fn(e^1759714724);if(typeof e==`boolean`)return e?1000000007:521288629;if(typeof e==`string`)return pn(e);if(e.kind===`Set`||e.kind===`Function`)return e.fingerprint===0&&(e.fingerprint=gn(e)),e.fingerprint;let t=dn.get(e);if(t!==void 0)return t;let n=gn(e);return dn.set(e,n),n},vn=/* @__PURE__ */ new WeakMap,yn=e=>{if(typeof e==`boolean`)return e?`T`:`F`;if(typeof e==`number`)return String(e);if(typeof e==`string`)return JSON.stringify(e);let t=vn.get(e);if(t!==void 0)return t;let n=bn(e);return vn.set(e,n),n},bn=e=>{if(e.kind===`ModelValue`)return`@${e.name}`;if(e.kind===`InfiniteSet`)return`<${e.name}>`;if(e.kind===`SequenceSet`)return`<Seq ${yn(e.base)}>`;if(e.kind===`FilteredSet`&&!L(e))throw new f(`Attempted to compare the non-enumerable set ${H(e)} with another value`);if(O(e))return L(e)?`{${R(e).elements.map(yn).join(`,`)}}`:`<${e.kind} ${H(e)}>`;let t=V(e);return`(${t.domain.map((e,n)=>`${yn(e)}:${yn(t.range[n])}`).join(`,`)})`},xn=e=>`"${e.replace(/\\/g,`\\\\`).replace(/"/g,`\\"`).replace(/\n/g,`\\n`).replace(/\t/g,`\\t`)}"`,Sn=e=>e.reduce((e,t)=>e===0?0:e*Ut(t),1),Cn=e=>{if(e.kind===`Subset`)return Ut(e.base)<=6?R(e):void 0;if(e.kind===`SetOperation`||e.kind===`FilteredSet`||e.kind===`Union`)return R(e);if(e.kind===`FunctionSet`&&L(e.domain)&&Ut(e.domain)===0)return Le([F([],[])]);let t=e.kind===`FunctionSet`?Ut(e.range)**Ut(e.domain):Sn(e.kind===`RecordSet`?e.sets:e.factors);return t===0?ht:t<=1999?R(e):void 0},wn=(e,t)=>{if(t)return Cn(e);if(L(e))try{return Cn(e)}catch(e){if(e instanceof f)return;throw e}},Tn=(e,t)=>{let n=e=>H(e,t);switch(e.kind){case`Subset`:return typeof e.base==`object`&&e.base.kind===`Interval`?`SUBSET (${n(e.base)})`:`SUBSET ${n(e.base)}`;case`FunctionSet`:return`[${n(e.domain)} -> ${n(e.range)}]`;case`RecordSet`:return`[${e.names.map((t,r)=>`${t}: ${n(e.sets[r])}`).join(`, `)}]`;case`ProductSet`:return`(${e.factors.map(n).join(` \\X `)})`;case`SetOperation`:return`${n(e.left)} ${e.operator} ${n(e.right)}`;case`FilteredSet`:return`{x \\in ${n(e.base)} : ...}`;case`Union`:return jt(e,t)}},En=e=>/^[\p{L}\p{Nd}_]*$/u.test(e)&&/\p{L}/u.test(e)&&(e.length<4||!/^[WS]F_/.test(e)),H=(e,t=!1,n=!1)=>{let r=e=>H(e,t,n);if(typeof e==`boolean`)return e?`TRUE`:`FALSE`;if(typeof e==`number`)return String(e);if(typeof e==`string`)return xn(e);switch(e.kind){case`ModelValue`:return e.name;case`Set`:return`{${e.elements.map(r).join(`, `)}}`;case`MixedSet`:return r(R(e));case`Interval`:return e.low<=e.high?`${e.low}..${e.high}`:`{}`;case`InfiniteSet`:return e.name===`Any`?`ANY`:e.name;case`Subset`:case`FunctionSet`:case`RecordSet`:case`ProductSet`:case`SetOperation`:case`FilteredSet`:case`Union`:{let n=wn(e,t);return n?r(n):Tn(e,t)}case`SequenceSet`:return`Seq(${r(e.base)})`;case`Function`:case`LazyFunction`:{if(e.kind===`LazyFunction`&&!L(e.domain)){let t=e.source;return t?`[${t.parameters.map(e=>`${e.name} \\in ${H(e.domain)}`).join(`, `)} |-> <expression ${t.body}>]`:`<function>`}let t=V(e);return t.domain.every((e,t)=>e===t+1)?`<<${t.range.map(r).join(`, `)}>>`:t.domain.every(e=>typeof e==`string`&&En(e))?`[${(n||t.hash!==0||t.fingerprint!==0?t.domain.map((e,n)=>[e,t.range[n]]):j(t)).map(e=>`${String(e[0])} |-> ${r(e[1])}`).join(`, `)}]`:`(${t.domain.map((e,n)=>`${r(e)} :> ${r(t.range[n])}`).join(` @@ `)})`}}},Dn=(e,t)=>{for(let n=0;n<e.length;n++)e[n]=t(e[n])},On=()=>{let e=/* @__PURE__ */ new Map,t=n=>{if(typeof n!=`object`||n.kind!==`Set`&&n.kind!==`Function`)return n;let r=un(n),i=e.get(r);if(i!==void 0&&!Array.isArray(i)&&(i===n||Be(i,n)))return i;if(Array.isArray(i)){for(let e=0;e<i.length;e++)if(i[e]===n||Be(i[e],n))return i[e]}return n.kind===`Set`?Dn(n.elements,t):(Dn(n.domain,t),Dn(n.range,t)),i===void 0?e.set(r,n):Array.isArray(i)?i.push(n):e.set(r,[i,n]),n};return e=>{for(let n=0;n<e.length;n++)e[n]=t(e[n]);return e}},kn=/* @__PURE__ */ new Set(/* @__PURE__ */ `=,#,~,<=>,/\\,\\/,=>,\\in,\\notin,\\subseteq,\\cup,\\cap,\\,SUBSET,UNION,DOMAIN,+,-,*,^,\\div,%,..,Seq,IsFiniteSet,RandomElement`.split(`,`)),An=(e,t)=>kn.has(e)?new f(t):new p(t),jn=e=>typeof e==`object`&&e.kind===`Operator`,U=(e,t,n)=>{let r=e[t];if(r===void 0||jn(r))throw An(n,`${n} expects a value as argument ${t+1}`);return r},Mn=(e,t,n)=>{let r=U(e,t,n);if(typeof r!=`number`)throw An(n,`${n} expects an integer but received ${H(r)}`);return r},Nn=(e,t,n)=>{let r=U(e,t,n);if(typeof r!=`boolean`)throw An(n,`${n} expects a boolean but received ${H(r)}`);return r},Pn=(e,t,n)=>{let r=U(e,t,n);if(!O(r))throw An(n,`${n} expects a set but received ${H(r)}`);return r},Fn=(e,t,n)=>{let r=Pn(e,t,n);if(!L(r))throw An(n,`${n} cannot enumerate the non-enumerable set ${H(r)}`);return r},In=(e,t,n)=>R(Fn(e,t,n)),Ln=(e,t,n)=>In(e,t,n).elements,Rn=(e,t,n)=>{let r=U(e,t,n),i=qt(r);if(!i)throw An(n,`${n} expects a sequence but received ${H(r)}`);return i},zn=(e,t,n)=>{let r=U(e,t,n);if(!k(r))throw An(n,`${n} expects a function but received ${H(r)}`);return V(r)},Bn=(e,t,n)=>{let r=e[t];if(r===void 0||!jn(r))throw An(n,`${n} expects an operator as argument ${t+1}`);return r},Vn=(e,t)=>({kind:`Builtin`,name:e,arity:0,evaluate:()=>t,evaluateUnary:void 0,evaluateBinary:void 0}),W=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:t===1?e=>n([e]):void 0,evaluateBinary:t===2?(e,t)=>n([e,t]):void 0}),Hn=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:void 0,evaluateBinary:void 0}),Un=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:void 0,evaluateBinary:void 0,isStateLevel:!0}),Wn=(e,t)=>({kind:`Builtin`,name:e,arity:2,evaluate:n=>t(U(n,0,e),U(n,1,e)),evaluateUnary:void 0,evaluateBinary:t}),Gn=e=>e>2147483647||e<-2147483648,Kn=e=>new p(`Overflow when computing ${e}`),qn={ModelValue:`ModelValue`,Set:`SetEnumValue`,Interval:`IntervalValue`,InfiniteSet:`UserValue`,SequenceSet:`UserValue`,Subset:`SubsetValue`,FunctionSet:`SetOfFcnsValue`,RecordSet:`SetOfRcdsValue`,ProductSet:`SetOfTuplesValue`,FilteredSet:`SetPredValue`,LazyFunction:`FcnLambdaValue`,Union:`UnionValue`,MixedSet:`SetEnumValue`},Jn={"\\cup":`SetCupValue`,"\\cap":`SetCapValue`,"\\":`SetDiffValue`},Yn={BoolValue:`a Boolean value`,IntValue:`an integer`,StringValue:`a string`,RecordValue:`a record`,SetEnumValue:`a set of the form {e1, ... ,eN}`,SetPredValue:`a set of the form {x \\in S : expr}`,TupleValue:`a tuple`,FcnLambdaValue:`a function of the form  [x \\in S |-> expr]`,FcnRcdValue:`a function  of the form (d1 :> e1 @@ ... @@ dN :> eN)`,SetOfFcnsValue:`a set of the form [S -> T]`,SetOfRcdsValue:`a set of the form [d1 : S1, ... , dN : SN]`,SetOfTuplesValue:`a cartesian product`,SubsetValue:`a set of the form SUBSET S`,SetDiffValue:`a set of the form S \\ T`,SetCapValue:`a set of the form S \\cap T`,SetCupValue:`a set of the form S \\cup T`,ModelValue:`a model value`,UserValue:`a special set constant`,IntervalValue:`a set of the form i..j`,UnionValue:`a set of the form UNION  S`},Xn=e=>{if(typeof e==`number`)return`IntValue`;if(typeof e==`string`)return`StringValue`;if(typeof e==`boolean`)return`BoolValue`;if(e.kind===`SetOperation`)return Jn[e.operator];if(e.kind!==`Function`)return qn[e.kind];let t=e.domain;return t.every((e,t)=>e===t+1)?`TupleValue`:t.every(e=>typeof e==`string`)?`RecordValue`:`FcnRcdValue`},Zn=e=>Yn[Xn(e)],Qn=(e,t)=>new f(`Attempted to apply the operator overridden by the Java method\n${e},\nbut it produced the following error:\n${t}`),$n=(e,t)=>{let n=n=>(...r)=>{try{return n(...r)}catch(n){throw n instanceof f&&(e.isLazy===!0||!(n instanceof p))?Qn(t,n.message):n}};return{...e,evaluate:n(e.evaluate),evaluateUnary:e.evaluateUnary&&n(e.evaluateUnary),evaluateBinary:e.evaluateBinary&&n(e.evaluateBinary)}},er=(e,t)=>{if(typeof e!=`number`)throw Qn(t,`Cannot cast tlc2.value.impl.${Xn(e)} to tlc2.value.impl.IntValue`);return e},tr=(e,t,n)=>`public static tlc2.value.impl.${t} tlc2.module.Integers.${e}(${Array.from({length:n},()=>`tlc2.value.impl.IntValue`).join(`,`)})`,nr=(e,t,n)=>{let r=tr(t,`IntValue`,2);return Wn(e,(t,i)=>{let a=er(t,r),o=er(i,r),s=n(a,o);if(Gn(s))throw Kn(`${a}${e}${o}`);return s})},rr=(e,t,n)=>{if(typeof e!=`number`)throw new p(`The ${t} argument of ${n} should be an integer, but instead it is:\n${H(e)}`);return e},ir=(e,t)=>Wn(e,(n,r)=>t(rr(n,`first`,e),rr(r,`second`,e))),ar=(e,t,n)=>({...Un(e,t,n),isLazy:!0}),or=(e,t,n)=>{let r=Bn(e,t,n);return()=>r.call([])},sr=/* @__PURE__ */ new Set([`Apply`,`And`,`Or`,`If`,`FunctionApplication`,`FieldAccess`,`Record`,`Tuple`,`SetEnumeration`,`Prime`,`Unchanged`,`Forall`,`Exists`]),cr=()=>({bool:Ha,condition:(e,t)=>{if(typeof e!=`boolean`)throw ja(t,e);return e},conjunct:(e,t,n)=>{if(typeof e!=`boolean`)throw Ma(t,n,e);return e},apply:$t,tuple:I,set:mt,record:F,writtenRecord:ve,equal:Re,enumerate:Ja,unassigned:(e,t)=>{throw new f(`The variable ${e} is not assigned at ${q(t)}`)},primeOutsideAction:e=>{throw new f(`A primed expression appears outside an action at ${q(e)}`)},prime:e=>({environment:e.environment,scope:e.scope,state:e.next,next:void 0}),extend:(e,t,n)=>({environment:e.environment,scope:t.reduce((e,t,r)=>za(e,t,n[r]),e.scope),state:e.state,next:e.next})}),lr={value:void 0},ur=(e,t)=>(e.references.push(t),`reference${e.references.length-1}`),dr=e=>`local${e.counter++}`,fr=(e,t=/* @__PURE__ */ new Set)=>(e.kind===`Identifier`&&t.add(e.name),e.kind===`Apply`&&t.add(e.operator),Ua(e).forEach(e=>fr(e,t)),t),pr=(e,t,n)=>{let r=ur(e,Y(t,e.environment)),i=fr(t),a=[...n.locals].filter(([e])=>i.has(e));if(a.length===0)return`${r}(${n.context})`;let o=ur(e,a.map(([e])=>e));return`${r}(extend(${n.context}, ${o}, [${a.map(([,e])=>e).join(`, `)}]))`},mr=(e,t,n)=>{let r=t.kind===`Forall`,i=JSON.stringify(r?`the body of \\A`:`the body of \\E`),a=`quantifier${e.counter++}`,o=[...n.locals.values()],s={context:`context`,state:`state`,next:`next`,isPrimed:!1,locals:new Map(n.locals)},c=t.bounds.map(()=>dr(e)),l=t.bounds.map((t,n)=>`const ${c[n]} = enumerate(${gr(e,t.set,s)}, ${ur(e,t.set)});`),u=t.bounds.map(t=>{let n=dr(e);return t.pattern.kind===`Name`&&s.locals.set(t.pattern.name,n),n}),d=`if (bool(${gr(e,t.body,s)}, ${i}) !== ${r}) return ${!r};`,f=u.reduce((t,n,r)=>{let i=dr(e);return`for (let ${i} = 0; ${i} < ${c[r]}.length; ${i}++) { const ${n} = ${c[r]}[${i}]; ${t} }`},d),p=o.map(e=>`, ${e}`).join(``);return e.helpers.push(`function ${a}(context, state, next${p}) { let primed; ${l.join(` `)} ${f} return ${r}; }`),`${a}(${n.context}, ${n.state}, ${n.isPrimed?`undefined`:n.next}${p})`},hr=(e,t,n)=>{let r=t.args;if(t.operator===`=>`)return`(bool(${gr(e,r[0],n)}, "the left side of =>") ? bool(${gr(e,r[1],n)}, "the right side of =>") : true)`;if(J(t))return pr(e,t,n);let i=co(t.operator,e.environment);if(i?.kind!==`Builtin`)return pr(e,t,n);if(i.name===`DOMAIN`)return`${ur(e,Pa(t))}(${gr(e,r[0],n)})`;if(i.name===`TLCEval`)return pr(e,t,n);if(i.name===`\\subseteq`&&r.length===2)return`${ur(e,Fa(t,i))}(${gr(e,r[0],n)}, ${gr(e,r[1],n)})`;let a=e.environment;if(i.evaluateUnary&&r.length===1&&Qo(r[0],a))return`${ur(e,i.evaluateUnary)}(${gr(e,r[0],n)})`;let o=r.length===2&&Qo(r[0],a)&&Qo(r[1],a);return i.evaluateBinary&&o?`${ur(e,i.evaluateBinary)}(${gr(e,r[0],n)}, ${gr(e,r[1],n)})`:pr(e,t,n)},gr=(e,t,n)=>{let r=(t,r=n)=>gr(e,t,r);if(Ho(t)&&Lo(t,e.environment))return pr(e,t,n);switch(t.kind){case`Number`:return Do(t.value)?String(t.value):pr(e,t,n);case`String`:return JSON.stringify(t.value);case`Identifier`:{let r=n.locals.get(t.name);if(r)return r;if(J(t))return pr(e,t,n);let i=yo(t.name,e.environment);if(i?.kind===`Variable`){let r=JSON.stringify(t.name),a=ur(e,t);return`(${n.state}?.[${i.index}] ?? unassigned(${r}, ${a}))`}return i?.kind===`Value`?ur(e,i.value):pr(e,t,n)}case`Apply`:return hr(e,t,n);case`And`:{let n=ur(e,t);return`(${t.operands.map((e,t)=>`conjunct(${r(e)}, ${n}, ${t})`).join(` && `)})`}case`Or`:return`(${t.operands.map(e=>`bool(${r(e)}, "a disjunct")`).join(` || `)})`;case`If`:return`(condition(${r(t.condition)}, ${ur(e,t)}) ? ${r(t.consequent)} : ${r(t.alternative)})`;case`FunctionApplication`:{fs(t.function);let e=r(t.function);return t.args.length===1?`apply(${e}, ${r(t.args[0])})`:`apply(${e}, tuple([${t.args.map(e=>r(e)).join(`, `)}]))`}case`FieldAccess`:return`apply(${r(t.record)}, ${JSON.stringify(t.field)}, ${ur(e,Na(t))})`;case`Record`:{let i=[...t.fields].sort((e,t)=>P(e.name,t.name));if(i.some((e,t)=>t>0&&i[t-1].name===e.name))return pr(e,t,n);let a=ur(e,i.map(e=>e.name)),o=`[${i.map(e=>r(e.value)).join(`, `)}]`,s=t.fields.map(e=>e.name);return s.every((e,t)=>e===i[t].name)?`record(${a}, ${o})`:`writtenRecord(${a}, ${o}, ${ur(e,s)})`}case`Tuple`:return`tuple([${t.elements.map(e=>r(e)).join(`, `)}])`;case`SetEnumeration`:return`set([${t.elements.map(e=>r(e)).join(`, `)}])`;case`Prime`:{let i=ur(e,t);if(n.isPrimed)return`primeOutsideAction(${i})`;let a={context:`(primed ??= prime(${n.context}))`,state:n.next,next:`undefined`,isPrimed:!0,locals:n.locals};return`(${n.next} === undefined ? primeOutsideAction(${i}) : ${r(t.expression,a)})`}case`Unchanged`:return`equal(${r({kind:`Prime`,expression:t.expression,location:t.location})}, ${r(t.expression)})`;case`Forall`:case`Exists`:return t.bounds.every(e=>e.pattern.kind===`Name`)?mr(e,t,n):pr(e,t,n);default:return pr(e,t,n)}},_r=(e,t)=>{if(!sr.has(e.kind))return;let n={environment:t,references:[],helpers:[],counter:0},r=gr(n,e,{context:`context`,state:`state`,next:`next`,isPrimed:!1,locals:/* @__PURE__ */ new Map}),i=n.references.map((e,t)=>`reference${t}`),a=`${n.helpers.join(`
+`)}\nreturn (context) => { const state = context.state; const next = context.next; let primed; return ${r}; };`;lr.value??=cr();let o=lr.value,s=Object.keys(o);return Function(...s,...i,a)(...Object.values(o),...n.references)},vr={kind:`Local`},yr=/* @__PURE__ */ new WeakMap,br=e=>{let t=e.lastIndexOf(`@`);return t>0&&t<e.length-1},xr=new Map([`~>`,`-+->`,`\\cdot`].map(e=>[e,{key:e,arity:2}])),Sr=(e,t)=>e.line<t.line||e.line===t.line&&e.column<t.column,Cr=e=>e.kind===`Operator`?e.params.length:0,wr=e=>e.name.includes(`!`),Tr=(e,t)=>{for(let n=e;n;n=n.parent)if(n.name===t)return n},Er=(e,t,n=0)=>t.reduce((e,t)=>({name:t,arity:n,parent:e}),e),Dr=(e,t)=>t.reduce((e,t)=>({name:t.name,arity:t.arity,parent:e}),e),Or=e=>e.kind===`Name`?[e.name]:e.names,kr=e=>e.flatMap(e=>Or(e.pattern)),Ar=(e,t)=>{let n=t.definitions.get(e);return n!==void 0&&(n===t.self?n.kind===`Function`||n.isRecursive:n.isRecursive||Sr(n.location,t.location))?n:void 0},jr=(e,t)=>{let n=Ar(e,t);return n?{key:t.getKey(n),arity:Cr(n)}:t.imported.get(e)},Mr=e=>e[0].toLowerCase()===e[0].toUpperCase()&&e[0]!==`_`&&(e[0]<`0`||e[0]>`9`),Nr=e=>e.startsWith(`<`)&&(e[1]>=`0`&&e[1]<=`9`||e[1]===`*`),Pr=(e,t,n,r)=>{let i=e.location,a=yr.get(e);if(a!==void 0)return a;if(br(t))return e.kind===`Apply`?e.args.length:0;if(Nr(t))return 0;let o=Tr(n,t);if(o&&e.kind!==`OperatorReference`&&(e.resolution=vr),o)return o.arity;let s=jr(t,r);if(s)return e.kind===`Identifier`?e.name=s.key:e.operator=s.key,yr.set(e,s.arity),s.arity;let c=t.slice(0,t.indexOf(`!`));if(c!==``&&(Tr(n,c)!==void 0||jr(c,r)!==void 0||r.facts.has(c)))return e.kind===`Apply`?e.args.length:0;let l=`at line ${i.line}, column ${i.column}`;throw new u(Mr(t)?`Could not find declaration or definition of symbol '${t}' ${l}`:`Unknown operator: \`${t}' ${l}`)},Fr=(e,t,n)=>(e.forEach(e=>G(e.set,t,n)),e.reduce((e,t)=>Er(e,Or(t.pattern)),t)),Ir=(e,t)=>e.kind===`Identifier`&&e.name===t&&J(e)||Ua(e).some(e=>Ir(e,t)),Lr=(e,t)=>{e.kind===`FunctionConstruction`&&Ir(e.body,t)&&(e.isRecursive=!0),Ua(e).forEach(e=>Lr(e,t))},Rr=(e,t,n)=>{let r=Er(t,e.kind===`Function`?[e.name]:[]);e.kind===`Function`?(G(e.body,Fr(e.bounds,r,n),n),Lr(e.body,e.name)):G(e.body,Dr(r,e.params),n)},zr=(e,t,n)=>{let r=e.filter(e=>e.isRecursive).reduce((e,t)=>({name:t.name,arity:Cr(t),parent:e}),t);return e.reduce((e,t)=>(wr(t)||Rr(t,e,n),{name:t.name,arity:Cr(t),parent:e}),r)},Br=(e,t,n,r,i)=>{let a=e.kind===`Operator`?e.params[t]:void 0,o=n.location;if(a?.arity===0&&r>0)throw new u(`Operator used in argument number ${t+1} has incorrect number of arguments at line ${o.line}, column ${o.column}`);let s=i?.kind===`Operator`&&i.params.some(e=>e.arity>0);if(a!==void 0&&a.arity>0&&(r!==a.arity||s))throw new u(`Argument number ${t+1} to operator '${e.name}' should be a ${a.arity}-parameter operator at line ${o.line}, column ${o.column}`)},Vr=e=>e.kind===`Identifier`?e.name:e.kind===`OperatorReference`?e.operator:void 0,Hr=(e,t,n)=>{let r=Tr(t,e.operator)?void 0:Ar(e.operator,n),i=Pr(e,e.operator,t,n);if(i!==e.args.length)throw new u(`The operator ${e.operator} requires ${i} arguments at line ${e.location.line}, column ${e.location.column}`);e.args.forEach((e,i)=>{let a=Vr(e),o=a===void 0||Tr(t,a)?void 0:Ar(a,n),s=Ur(e,t,n);r&&Br(r,i,e,s,o)})},Ur=(e,t,n)=>e.kind===`Identifier`?Pr(e,e.name,t,n):e.kind===`OperatorReference`?Pr(e,e.operator,t,n):(G(e,t,n),e.kind===`Lambda`?e.params.length:0),G=(e,t,n)=>{let r=e=>e.forEach(e=>G(e,t,n));switch(e.kind){case`Number`:case`Decimal`:case`String`:case`ExceptAt`:return;case`Identifier`:{let r=Pr(e,e.name,t,n);if(r>0)throw new u(`The operator ${e.name} requires ${r} arguments at line ${e.location.line}, column ${e.location.column}`);return}case`OperatorReference`:Pr(e,e.operator,t,n);return;case`Apply`:Hr(e,t,n);return;case`Lambda`:G(e.body,Er(t,e.params),n);return;case`And`:case`Or`:r(e.operands);return;case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:G(e.expression,t,n);return;case`If`:r([e.condition,e.consequent,e.alternative]);return;case`Case`:r(e.arms.flatMap(e=>[e.condition,e.body])),e.other&&G(e.other,t,n);return;case`Let`:G(e.body,zr(e.definitions,t,n),n);return;case`Forall`:case`Exists`:case`FunctionConstruction`:G(e.body,Fr(e.bounds,t,n),n);return;case`UnboundedQuantifier`:G(e.body,Er(t,e.names),n);return;case`Choose`:e.set&&G(e.set,t,n),G(e.body,Er(t,Or(e.pattern)),n);return;case`SetEnumeration`:case`Tuple`:r(e.elements);return;case`SetFilter`:G(e.predicate,Fr([e.bound],t,n),n);return;case`SetMap`:G(e.expression,Fr(e.bounds,t,n),n);return;case`FunctionSet`:r([e.domain,e.range]);return;case`Record`:case`RecordSet`:if(new Set(e.fields.map(e=>e.name)).size<e.fields.length)throw new u(`Non-unique fields in constructor at line ${e.location.line}, column ${e.location.column}`);r(e.fields.map(e=>e.value));return;case`Except`:r([e.function,...e.updates.flatMap(e=>[...e.path.flatMap(e=>e.kind===`Index`?e.args:[]),e.value])]);return;case`FunctionApplication`:r([e.function,...e.args]);return;case`FieldAccess`:G(e.record,t,n);return;case`Product`:r(e.factors);return;case`BoxAction`:case`AngleAction`:r([e.action,e.subscript]);return;case`WeakFairness`:case`StrongFairness`:r([e.subscript,e.action]);return;case`Label`:G(e.body,t,n);return;case`Subexpression`:e.selectors.flatMap(e=>`args`in e?e.args:[]).forEach(e=>Ur(e,t,n))}},Wr=(e,t,n)=>(e.set&&G(e.set,t,n),{name:e.name,arity:e.arity,parent:t}),Gr=(e,t,n)=>{let r=e.assumptions.reduce((e,t)=>t.kind===`NewSymbol`?Wr(t,e,n):(t.kind===`AssumeProve`?Gr(t,e,n):G(t,e,n),e),t);return G(e.conclusion,r,n),r},Kr=(e,t,n)=>e.kind===`AssumeProve`?Gr(e,t,n):(G(e,t,n),t),qr=(e,t,n)=>{e?.kind===`Steps`&&e.steps.reduce((e,t)=>Jr(t,e,n),t)},Jr=(e,t,n)=>{let r=e.body;switch(r.kind){case`Assert`:{let i=Kr(r.statement,t,n);return qr(e.proof,i,n),r.isSuffices?i:t}case`Define`:return zr(r.definitions.flatMap(e=>e.kind===`Instance`?[]:[e]),t,n);case`Have`:case`Case`:return G(r.expression,t,n),qr(e.proof,t,n),t;case`Witness`:return r.expressions.forEach(e=>G(e,t,n)),t;case`Take`:return Er(Fr(r.bounds,t,n),r.names);case`Pick`:{let i=Er(Fr(r.bounds,t,n),r.names);return G(r.body,i,n),qr(e.proof,t,n),i}default:return qr(e.proof,t,n),t}},Yr=(e,t)=>{let n=e.name!==void 0&&e.statement.kind!==`AssumeProve`?void 0:Kr(e.statement,void 0,t);qr(e.proof,n,t)},Xr=(e,t)=>new u(`Multiply-defined symbol '${e}' at line ${t.line}, column ${t.column}`),Zr=(e,t,n,r)=>t.reduce((e,t)=>{if(Tr(e,t)||n(t))throw Xr(t,r);return{name:t,arity:0,parent:e}},e),Qr=(e,t,n,r)=>(e.forEach(e=>ei(e.set,t,n)),e.reduce((e,t)=>Zr(e,Or(t.pattern),n,r),t)),$r=(e,t,n)=>{if(e.kind===`Function`){let r=Er(t,[e.name]),i=Qr(e.bounds,r,n,e.location);ei(e.body,i,n);return}let r=Zr(t,e.params.map(e=>e.name),n,e.location);ei(e.body,r,n)},ei=(e,t,n)=>{let r=e.location;switch(e.kind){case`Lambda`:ei(e.body,Zr(t,e.params,n,r),n);return;case`Let`:{let i=e.definitions.filter(e=>e.isRecursive).map(e=>e.name),a=e.definitions.reduce((e,t)=>{if(Tr(e,t.name)||n(t.name))throw Xr(t.name,t.location);return $r(t,Er(e,i),n),Er(e,[t.name])},t);ei(e.body,Zr(a,(e.instances??[]).flatMap(e=>e.name===void 0?[]:[e.name]),n,r),n);return}case`Forall`:case`Exists`:case`FunctionConstruction`:ei(e.body,Qr(e.bounds,t,n,r),n);return;case`SetFilter`:ei(e.predicate,Qr([e.bound],t,n,r),n);return;case`SetMap`:ei(e.expression,Qr(e.bounds,t,n,r),n);return;case`UnboundedQuantifier`:ei(e.body,Zr(t,e.names,n,r),n);return;case`Choose`:e.set&&ei(e.set,t,n),ei(e.body,Zr(t,Or(e.pattern),n,r),n);return;default:Ua(e).forEach(e=>ei(e,t,n))}},ti=e=>[...e.definitions.map(e=>({name:e.name,kind:`Definition`,location:e.location,isRecursive:e.isRecursive})),...e.instances.flatMap(e=>e.name===void 0?[]:[{name:e.name,kind:`Definition`,location:e.location,isRecursive:!1}]),...e.constants.map(e=>({name:e.name,kind:`Constant`,location:e.location,isRecursive:!1})),...e.variables.map(e=>({name:e.name,kind:`Variable`,location:e.location,isRecursive:!1}))],ni=(e,t)=>{let n=/* @__PURE__ */ new Map;ti(e).sort((e,t)=>Sr(e.location,t.location)?-1:1).forEach(e=>n.set(e.name,[...n.get(e.name)??[],e]));let r=(e,n)=>{if(!t.imported.has(e)&&!xr.has(e))return!1;let r=t.importedAt.get(e);return r===void 0||Sr(r,n)};n.forEach(e=>e.forEach((n,i)=>{let a=e.slice(0,i).some(e=>e.kind===`Definition`||n.kind===`Definition`||e.kind!==n.kind),o=t.imported.get(n.name)?.declaration===n.kind;if(a||!o&&r(n.name,n.location))throw Xr(n.name,n.location)}));let i=e=>t=>(n.get(t)??[]).some(t=>t.isRecursive||Sr(t.location,e))||r(t,e);e.definitions.forEach(e=>$r(e,void 0,i(e.location))),e.assumptions.forEach(e=>ei(e.expression,void 0,i(e.location))),e.instances.forEach(e=>{let t=i(e.location),n=Zr(void 0,e.params.map(e=>e.name),t,e.location);e.substitutions.forEach(e=>ei(e.expression,n,t))})},ri=(e,t)=>{let n=new Map([...xr,...t]);return e.constants.forEach(e=>n.set(e.name,{key:e.name,arity:e.arity})),e.variables.forEach(e=>n.set(e.name,{key:e.name,arity:0})),n},ii=(e,t,n,r)=>{let i=Dr(void 0,e.params),a={imported:ri(n,r.imported),definitions:r.definitions,getKey:r.getKey,location:e.location,self:void 0,facts:/* @__PURE__ */ new Set},o=new Map(e.substitutions.map(e=>[e.name,e.expression])),s=`in the instance of ${e.module} at line ${e.location.line}, column ${e.location.column}`;return o.forEach((e,n)=>{if(t.every(e=>e.name!==n))throw new u(`Identifier '${n}' is not a legal target of a substitution ${s}`)}),new Map(t.map(t=>{let n=t.name;if(!o.has(n)&&!Tr(i,n)&&!jr(n,a))throw new u(`Substitution missing for symbol ${n} ${s}`);let r=o.get(n)??{kind:`Identifier`,name:n,location:e.location};if(t.arity===0||r.kind!==`Identifier`)return G(r,i,a),[n,r];if(Pr(r,r.name,i,a)!==t.arity)throw new u(`An operator must be substituted for symbol '${n}', and it must have arity ${t.arity} ${s}`);return[n,r]}))},ai=(e,t)=>{let n=ri(e,t.imported),r=new Set([...e.theorems,...e.assumptions].flatMap(e=>e.name??[])),i=(e,i)=>({imported:n,definitions:t.definitions,getKey:t.getKey,location:e,self:i,facts:r});e.definitions.forEach(e=>Rr(e,void 0,i(e.location,e))),e.assumptions.forEach(e=>G(e.expression,void 0,i(e.location,void 0))),e.theorems.forEach(e=>Yr(e,i(e.location,void 0)))},oi=/* @__PURE__ */ new WeakSet,si=/* @__PURE__ */ new WeakSet,ci=(e,t,n=/* @__PURE__ */ new Set)=>{let r=mi(e,(e,r)=>ci(e,t,r.length===0?n:/* @__PURE__ */ new Set([...n,...r])));return r.kind===`Identifier`&&J(r)&&!n.has(r.name)?{...r,name:t.get(r.name)??r.name}:r.kind===`Apply`&&J(r)&&!n.has(r.operator)?{...r,operator:t.get(r.operator)??r.operator}:r},li=(e,t)=>e.map(e=>({pattern:e.pattern,set:t(e.set)})),ui=/* @__PURE__ */ new WeakMap,di=e=>ui.get(e)??e.name,fi=(e,t)=>(di(t)!==e.name&&ui.set(e,di(t)),e),pi=(e,t)=>fi(e.kind===`Function`?{...e,bounds:li(e.bounds,e=>t(e,[])),body:t(e.body,kr(e.bounds))}:{...e,body:t(e.body,e.params.map(e=>e.name))},e),mi=(e,t)=>{let n=e=>t(e,[]);switch(e.kind){case`Number`:case`Decimal`:case`String`:case`Identifier`:case`OperatorReference`:case`ExceptAt`:return e;case`Apply`:return{...e,args:e.args.map(n)};case`Lambda`:return{...e,body:t(e.body,e.params)};case`And`:case`Or`:return{...e,operands:e.operands.map(n)};case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return{...e,expression:n(e.expression)};case`If`:return{...e,condition:n(e.condition),consequent:n(e.consequent),alternative:n(e.alternative)};case`Case`:return{...e,arms:e.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),other:e.other?n(e.other):void 0};case`Let`:{let n=e.definitions.map(e=>e.name);return{...e,definitions:e.definitions.map(e=>pi(e,(e,r)=>t(e,[...n,...r]))),body:t(e.body,n)}}case`Forall`:case`Exists`:case`FunctionConstruction`:return{...e,bounds:li(e.bounds,n),body:t(e.body,kr(e.bounds))};case`UnboundedQuantifier`:return{...e,body:t(e.body,e.names)};case`Choose`:return{...e,set:e.set?n(e.set):void 0,body:t(e.body,Or(e.pattern))};case`SetEnumeration`:case`Tuple`:return{...e,elements:e.elements.map(n)};case`SetFilter`:return{...e,bound:{pattern:e.bound.pattern,set:n(e.bound.set)},predicate:t(e.predicate,Or(e.bound.pattern))};case`SetMap`:return{...e,bounds:li(e.bounds,n),expression:t(e.expression,kr(e.bounds))};case`FunctionSet`:return{...e,domain:n(e.domain),range:n(e.range)};case`Record`:case`RecordSet`:return{...e,fields:e.fields.map(e=>({name:e.name,value:n(e.value)}))};case`Except`:return{...e,function:n(e.function),updates:e.updates.map(e=>({path:e.path.map(e=>e.kind===`Index`?{kind:`Index`,args:e.args.map(n)}:e),value:n(e.value)}))};case`FunctionApplication`:return{...e,function:n(e.function),args:e.args.map(n)};case`FieldAccess`:return{...e,record:n(e.record)};case`Product`:return{...e,factors:e.factors.map(n)};case`BoxAction`:case`AngleAction`:return{...e,action:n(e.action),subscript:n(e.subscript)};case`WeakFairness`:case`StrongFairness`:return{...e,subscript:n(e.subscript),action:n(e.action)};case`Label`:return{...e,body:n(e.body)};case`Subexpression`:return{...e,selectors:e.selectors.map(e=>`args`in e?{...e,args:e.args.map(n)}:e)}}},hi=`LAMBDA`,gi=(e,t=/* @__PURE__ */ new Set)=>{let n=e.kind===`Identifier`?e.name:e.kind===`Apply`||e.kind===`OperatorReference`?e.operator:void 0,r=n===void 0||t.has(n)?[]:[n];return mi(e,(e,n)=>(r.push(...gi(e,n.length===0?t:/* @__PURE__ */ new Set([...t,...n]))),e)),r},_i=e=>{let t=/* @__PURE__ */ new Map;return n=>{if(!e.substitutedNames.has(n))return n;let r=t.get(n)??e.instantiation.createName(n);return t.set(n,r),r}},vi=(e,t,n)=>new Map([...e,...t.map(e=>[e,n(e)])]),yi=(e,t)=>e.kind===`Name`?{kind:`Name`,name:t(e.name)}:{kind:`Tuple`,names:e.names.map(t)},bi=(e,t)=>e.map(e=>({pattern:yi(e.pattern,t),set:e.set})),xi=(e,t)=>e.kind===`Function`?{...e,bounds:bi(e.bounds,t)}:{...e,params:e.params.map(e=>({name:t(e.name),arity:e.arity}))},Si=(e,t,n)=>{let r=e=>t.get(e)??e;switch(e.kind){case`Identifier`:return{...e,name:r(e.name)};case`Apply`:case`OperatorReference`:return{...e,operator:r(e.operator)};case`Label`:return{...e,params:e.params.map(r)};case`Lambda`:return{...e,params:e.params.map(n)};case`Let`:return{...e,definitions:e.definitions.map(e=>fi({...xi(e,n),name:n(e.name)},e))};case`Forall`:case`Exists`:case`FunctionConstruction`:case`SetMap`:return{...e,bounds:bi(e.bounds,n)};case`UnboundedQuantifier`:return{...e,names:e.names.map(n)};case`Choose`:return{...e,pattern:yi(e.pattern,n)};case`SetFilter`:return{...e,bound:{pattern:yi(e.bound.pattern,n),set:e.bound.set}};default:return e}},Ci=e=>`${e}@ENABLED`,wi=(e,t)=>e.modes.get(t)??e,Ti=(e,t,n)=>e.kind===`Identifier`&&!n.has(e.name)&&!J(e)&&t.instantiation.variables.has(e.name),Ei=(e,t,n)=>{if(e.kind===`Tuple`){let r=e.elements.map(e=>Ei(e,t,n));return r.every(e=>e!==void 0)?r.flat():void 0}if(e.kind!==`Identifier`)return;if(Ti(e,t,n))return[e.name];let r=J(e)?void 0:t.instantiation.getDefinition(e.name);return r?.kind===`Operator`&&r.params.length===0?Ei(r.body,t,/* @__PURE__ */ new Map):void 0},Di=(e,t,n)=>{if(t.mode===`Normal`)return;if(t.mode===`Primed`)return Ti(e,t,n)&&e.kind===`Identifier`?{kind:`Identifier`,name:Ci(e.name),location:e.location}:void 0;if(e.kind===`Prime`)return{...e,expression:Mi(e.expression,wi(t,`Primed`),n)};if(e.kind===`AngleAction`){let r=e.location;return{kind:`And`,operands:[Mi(e.action,t,n),{kind:`Apply`,operator:`#`,args:[{kind:`Prime`,expression:Mi(e.subscript,wi(t,`Primed`),n),location:r},Mi(e.subscript,t,n)],location:r}],location:r}}if(e.kind!==`Unchanged`)return;let r=Ei(e.expression,t,n);if(r!==void 0)return{kind:`And`,operands:r.map(r=>({kind:`Apply`,operator:`=`,args:[{kind:`Prime`,expression:{kind:`Identifier`,name:Ci(r),location:e.location},location:e.location},Mi({kind:`Identifier`,name:r,location:e.location},t,n)],location:e.location})),location:e.location}},Oi=(e,t)=>({kind:`Identifier`,name:e,location:t,resolution:{kind:`Local`}}),ki=(e,t)=>e.map(e=>Oi(e.name,t)),Ai=(e,t,n,r)=>{let i=Array.from({length:n},(e,t)=>`argument${t}`);return{kind:`Lambda`,params:i,body:{kind:`Apply`,operator:e,args:[...ki(t,r),...i.map(e=>Oi(e,r))],location:r},location:r}},ji=(e,t)=>e.instantiation.isParameterized(t)?Pi(e,t):void 0,Mi=(e,t,n)=>{let r=e=>Mi(e,t,n),i=t.instantiation,a=i.params,o=t=>!n.has(t)&&!J(e);if(e.kind===`Enabled`&&t.mode===`Normal`)return{...e,expression:Mi(e.expression,wi(t,`Enabled`),n)};if((e.kind===`WeakFairness`||e.kind===`StrongFairness`)&&t.mode===`Normal`)return{...e,subscript:r(e.subscript),action:r(e.action),enabled:Mi(e.enabled??{kind:`AngleAction`,action:e.action,subscript:e.subscript,location:e.location},wi(t,`Enabled`),n)};let s=Di(e,t,n);if(s)return s;if(e.kind===`Identifier`&&o(e.name)){let n=i.substitutions.get(e.name);if(n)return oi.add(n),n;let r=ji(t,e.name);if(r===void 0)return e;if(a.length===0)return{...e,name:r};let o=i.getDefinition(e.name);return o&&Cr(o)>0?Ai(r,a,Cr(o),e.location):{kind:`Apply`,operator:r,args:ki(a,e.location),location:e.location}}if(e.kind===`Apply`&&o(e.operator)){let n=e.args.map(r),o=i.substitutions.get(e.operator),s=i.substitutions.size>0||a.length>0||si.has(e),c=e=>(s&&si.add(e),e);if(o?.kind===`Identifier`||o?.kind===`OperatorReference`){let t=o.kind===`Identifier`?o.name:o.operator;return c({...e,operator:t,args:n,resolution:o.kind===`Identifier`?o.resolution:void 0})}if(o?.kind===`Apply`)return c({...e,operator:o.operator,args:[...o.args,...n],resolution:o.resolution});if(o?.kind===`Lambda`)return{kind:`Let`,definitions:[{kind:`Operator`,name:hi,params:o.params.map(e=>({name:e,arity:0})),body:o.body,isLocal:!0,isRecursive:!1,location:o.location}],body:{...e,operator:hi,args:n,resolution:{kind:`Local`}},location:e.location};if(o)throw new u(`The operator ${e.operator} can only be substituted by an operator at line ${e.location.line}, column ${e.location.column}`);let l=ji(t,e.operator);return l===void 0?c({...e,args:n}):{...e,operator:l,args:[...ki(a,e.location),...n]}}if(e.kind===`OperatorReference`&&o(e.operator)){let n=ji(t,e.operator);if(n===void 0)return e;let r=i.getDefinition(e.operator);return a.length>0&&r?Ai(n,a,Cr(r),e.location):{...e,operator:n}}let c=_i(t),l=mi(e,(e,i)=>i.length===0?r(e):Mi(e,t,vi(n,i,c)));return Si(l,n,c)},Ni=(e,t,n)=>t.length===0?e:e.kind===`Operator`?{...e,params:[...t,...e.params]}:{kind:`Operator`,name:e.name,params:t,body:{kind:`Let`,definitions:[e],body:Oi(e.name,n),location:n},isLocal:e.isLocal,isRecursive:!1,location:e.location},Pi=(e,t)=>{let n=e.copies.get(t);if(n!==void 0)return n;let r=e.instantiation,i=r.getDefinition(t);return i?r.addDefinition(i.name,n=>{e.copies.set(t,n);let a=_i(e),o=xi(pi(i,(t,n)=>Mi(t,e,vi(/* @__PURE__ */ new Map,n,a))),a);return Ni(o,r.params,i.location)}):t},Fi=e=>{let t=/* @__PURE__ */ new Map,n=new Set([...e.substitutions.values()].flatMap(e=>gi(e))),r=r=>{let i={instantiation:e,substitutedNames:n,copies:/* @__PURE__ */ new Map,mode:r,modes:t};return t.set(r,i),i},i=r(`Normal`);return r(`Enabled`),r(`Primed`),{getKey:e=>ji(i,e)??e,getQualifiedKey:t=>{let n=ji(i,t);if(n!==void 0)return n;let r=e.getDefinition(t);return r?e.addDefinition(r.name,()=>Ni(r,e.params,r.location)):t}}},Ii=e=>e.kind===`Let`&&e.instances!==void 0||Ua(e).some(Ii),Li=(e,t,n)=>{let r=e.kind===`Let`?[...n,...e.definitions]:n,i=mi(e,e=>Li(e,t,r));return i.kind!==`Let`||!i.instances?i:{kind:`Let`,definitions:i.instances.reduce((e,n)=>{let i=e.findIndex(e=>Sr(n.location,e.location)),a=i===-1?e.length:i;return[...e.slice(0,a),...t(n,r),...e.slice(a)]},i.definitions),body:i.body,location:i.location}},Ri=e=>e.name===void 0&&e.statement.kind!==`AssumeProve`?e.statement:void 0,zi=(e,t)=>e.definitions.some(e=>Ii(e.body))||e.assumptions.some(e=>Ii(e.expression))||e.theorems.some(e=>{let t=Ri(e);return t!==void 0&&Ii(t)})?{...e,definitions:e.definitions.map(e=>pi(e,e=>Li(e,t,[]))),assumptions:e.assumptions.map(e=>({...e,expression:Li(e.expression,t,[])})),theorems:e.theorems.map(e=>{let n=Ri(e);return n===void 0?e:{...e,statement:Li(n,t,[])}})}:e,Bi=/* @__PURE__ */ new WeakMap,Vi=/* @__PURE__ */ new WeakMap,K=(e,t,n)=>e.isInit?{environment:e.environment,scope:t,state:n,next:void 0}:{environment:e.environment,scope:t,state:e.current,next:n},Hi=(e,t,n)=>{let r=e.slice();return r[t]=n,r},Ui=(t,n)=>{let r=X(t,n);if(typeof r==`boolean`)return r;try{return Ha(r,`the action at ${q(t)}`)}catch(t){throw n.next===void 0?t:a(t,e.error)}},Wi=e=>e===`=`||e===`\\in`||e===`\\subseteq`,Gi=(e,t,n)=>{let r=n?Bi:Vi,i=r.get(e);if(i)return i;let a=ya(e,t,n);return r.set(e,a),a},Ki=(e,t)=>{if(t.constants.has(e))return;let n=Wa(e,t);return n?.kind===`Operator`&&n.params.length===0?n:void 0},qi=(e,t,n,r=/* @__PURE__ */ new Set)=>{if(e.kind===`Prime`&&n)return qi(e.expression,t,!1,r);if(e.kind!==`Identifier`||J(e))return;let i=t.variableIndex.get(e.name);if(i!==void 0)return n?void 0:i;let a=Ki(e.name,t);if(a&&!r.has(a))return r.add(a),qi(a.body,t,n,r)},Ji=(e,t,n)=>qi(e,t,!n),Yi=(e,t,n,r,i)=>{if(e.kind===`Prime`&&i)return Yi(e.expression,t,n,r,!1);if(e.kind===`Let`){let a=To(e.definitions,K(r,t,n));return Yi(e.body,a,n,r,i)}if(e.kind!==`Identifier`)return;let a=Ra(t,e.name);if(a?.kind===`Thunk`)return Yi(a.expression,a.scope,n,r,i);if(a)return;let o=r.environment.variableIndex.get(e.name);if(o!==void 0)return i?void 0:o;let s=Ki(e.name,r.environment);if(s)return Yi(s.body,void 0,n,r,i)},Xi=(e,t)=>e.kind===`Let`||e.kind===`Identifier`&&(t||J(e))||!t&&e.kind===`Prime`,Zi=(e,t,n=/* @__PURE__ */ new Set)=>{if(e.kind===`Tuple`){let r=e.elements.map(e=>Zi(e,t,n));return r.every(e=>e!==void 0)?r.flat():void 0}if(e.kind!==`Identifier`||n.has(e.name))return;let r=t.variableIndex.get(e.name);if(r!==void 0)return[r];let i=Ki(e.name,t);if(i)return n.add(e.name),Zi(i.body,t,n)},Qi=/* @__PURE__ */ new Set([`Label`,`And`,`Or`,`Exists`,`Forall`,`If`,`Case`,`Let`,`Unchanged`,`BoxAction`,`AngleAction`,`FunctionApplication`]),$i=(e,t,n)=>Qi.has(e.kind)?!1:e.kind===`Identifier`?t.variableIndex.has(e.name)||t.constants.has(e.name):e.kind===`Apply`?e.operator===`=>`||Wi(e.operator)&&(Xi(e.args[0],n)||Ji(e.args[0],t,n)!==void 0)||J(e)?!1:t.definitions.get(t.substitutions.get(e.operator)??e.operator)===void 0&&t.builtins.has(e.operator):!0,ea=/* @__PURE__ */ new Set,ta=(e,t)=>{if(J(e))return e.kind===`Identifier`?t.has(e.name)?[]:[e.name]:void 0;let n=[],r={isReadOnly:!0};return mi(e,(e,i)=>{let a=r.isReadOnly?ta(e,i.length===0?t:/* @__PURE__ */ new Set([...t,...i])):[];return a?n.push(...a):r.isReadOnly=!1,e}),r.isReadOnly?n:void 0},na=(e,t,n)=>{if(e.kind===`Or`||e.kind===`Exists`)return!0;let r=e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0,i=r===void 0||J(e)?void 0:Wa(r,t);return i&&!n.has(i)&&(n.add(i),na(i.body,t,n))?!0:Ua(e).some(e=>na(e,t,n))},ra=(e,t,n)=>{if(e.kind===`Apply`&&e.operator===`=`){let r=Ji(e.args[0],t,n);if(r!==void 0)return{kind:`Assign`,expression:e,index:r,value:e.args[1]}}if(!n&&e.kind===`Unchanged`){let n=Zi(e.expression,t);if(n)return{kind:`Unchanged`,expression:e,indices:n}}return $i(e,t,n)?{kind:`Guard`,expression:e}:{kind:`Branch`,expression:e,runner:Gi(e,t,n)}},ia=(e,t,n)=>{let r=e.map(e=>ra(e,t,n)),i=(e,t,n,a,o,s)=>{let c=a,l;for(let a=e;a<r.length;a++){if(a>0&&t.isInit&&Ca(c)){l??=K(t,n,c);for(let e=a;e<r.length;e++)if(!aa(r[e].expression,l))return;s(c,o);return}let e=r[a];if(e.kind===`Guard`){if(l??=K(t,n,c),!Ui(e.expression,l))return;continue}if(e.kind===`Assign`){l??=K(t,n,c);let r=X(e.value,l),i=c[e.index];if(i===void 0)c=Hi(c,e.index,r),l=void 0;else if(!Re(i,r))return;continue}if(e.kind===`Unchanged`){let n=t.current;if(!n)return;for(let t of e.indices){let e=c[t];if(e===void 0)c=Hi(c,t,n[t]),l=void 0;else if(!Re(e,n[t]))return}continue}let u=a+1;e.runner(t,n,c,o,!0,(e,r)=>i(u,t,n,e,r,s));return}s(c,o)};return(e,t,n,r,a,o)=>i(0,e,t,n,r,o)},aa=(e,t)=>Ha(X(e,t),`the initial predicate at ${q(e)}`),oa=e=>(t,n,r,i,a,o)=>{Ui(e,K(t,n,r))&&o(r,i)},sa=(e,t)=>{let n=e.args[1];return(r,i,a,o,s,c)=>{let l=t(r,i,a),u=K(r,i,a);if(a[l]!==void 0){Ui(e,u)&&c(a,o);return}let d=X(n,u),p=e.operator===`\\subseteq`?{kind:`Subset`,base:d}:d;if(!L(p))throw new f(`In computing next states, the right side of \\in is not enumerable: ${H(p)} at ${q(e)}`);let m=Bt(p);for(let e=0;e<m.length&&!r.isStopped;e++)c(Hi(a,l,m[e]),o)}},ca=/* @__PURE__ */ new WeakMap,la=e=>{let t=ca.get(e);if(t)return t;let n=e.kind===`Tuple`?{kind:`And`,operands:e.elements.map(la),location:e.location}:{kind:`Unchanged`,expression:e,location:e.location};return ca.set(e,n),n},ua=(e,t)=>{let n=e.args[0],r=oa(e),i=(e,r,i)=>Yi(n,r,i,e,!t)??-1,a=sa(e,i);return(t,n,o,s,c,l)=>{let u=i(t,n,o);if(u===-1||o[u]!==void 0){r(t,n,o,s,c,l);return}if(e.operator!==`=`){a(t,n,o,s,c,l);return}let d=X(e.args[1],K(t,n,o));l(Hi(o,u,d),s)}},da=(e,t,n,r)=>{if(e.kind===`FunctionConstruction`)return{bounds:e.bounds,body:e.body,scope:t};if(e.kind!==`Identifier`)return;let i=Ra(t,e.name);if(i?.kind===`Thunk`)return da(i.expression,i.scope,n,r);let a=i?void 0:Wa(e.name,r.environment);if(a?.kind!==`Function`)return;let o=X(e,K(r,void 0,n));return{bounds:a.bounds,body:a.body,scope:za(void 0,a.name,o)}},fa=(e,t,n)=>{let r=oa(e);return(i,a,o,s,c,l)=>{let u=da(e.function,a,o,i);if(!u){r(i,a,o,s,c,l);return}let d=K(i,a,o),p=e.args.map(e=>X(e,d)),m=p.length===1?p[0]:I(p),h=Xa(u.bounds,K(i,u.scope,o));if(!B(m,h))throw new f(`Attempted to apply a function to ${H(m)}, which is not in its domain at ${q(e)}`);Gi(u.body,t,n)(i,Za(u.bounds,u.scope,m),o,s,c,l)}},pa=(e,t)=>{if(Zi(e,t))return ia([la(e)],t,!1);if(e.kind===`Tuple`)return Gi(la(e),t,!1);let n=la(e);return(r,i,a,o,s,c)=>{let l=e.kind===`Identifier`?Ra(i,e.name):void 0;l?.kind===`Thunk`?Gi(la(l.expression),t,!1)(r,l.scope,a,o,s,c):Ui(n,K(r,i,a))&&c(a,o)}},ma=(e,t,n)=>{let r=e.operator,i=oa(e),a=J(e)?void 0:co(r,t);if(a?.kind===`Builtin`)return i;if(a?.kind===`Closure`){let i=ts(a,e.args,t),o={body:void 0};return(e,s,c,l,u,d)=>{o.body??=Gi(a.body,t,n),o.body(e,i(K(e,s,c)),c,u?l:r,u,d)}}return(a,o,s,c,l,u)=>{let d=K(a,o,s),f=uo(e,d);f?.kind===`Closure`?Gi(f.body,t,n)(a,Co(f,e.args,d),s,l?c:r,l,u):i(a,o,s,c,l,u)}},ha=(e,t,n)=>{let r=oa(e),i=J(e)?void 0:Ki(e.name,t),a={body:void 0};return(o,s,c,l,u,d)=>{let f=Ra(s,e.name);f?.kind===`Thunk`?Gi(f.expression,t,n)(o,f.scope,c,l,u,d):f||!i?r(o,s,c,l,u,d):(a.body??=Gi(i.body,t,n),a.body(o,void 0,c,u?l:i.name,u,d))}},ga=(e,t,n)=>{if(n.has(e))return;if(n.add(e),e.kind===`And`){let n=e.operands[0];if(n.kind!==`Apply`||n.operator!==`=`||J(n))return;let r=n.args[0],i=n.args[1];if(r.kind!==`FunctionApplication`||i.kind!==`String`)return;let a=r.args.length===1?r.args[0]:void 0;if(a?.kind!==`Identifier`||!J(a))return;let o=qi(r.function,t,!1);return o===void 0?void 0:{variable:o,argument:a.name,labels:/* @__PURE__ */ new Set([i.value])}}if(e.kind===`Or`){let r=e.operands.map(e=>ga(e,t,n)),i=r[0],a=r.every(e=>e!==void 0&&e.variable===i?.variable&&e.argument===i.argument);if(!i||!a)return;let o=new Set(r.flatMap(e=>[...e?.labels??[]]));return{variable:i.variable,argument:i.argument,labels:o}}if(e.kind!==`Apply`||J(e))return;let r=co(e.operator,t);if(r?.kind!==`Closure`||r.scope!==void 0)return;let i=ga(r.body,t,n),a=r.params.findIndex(e=>e.arity===0&&e.name===i?.argument),o=e.args[a];if(i&&o?.kind===`Identifier`&&J(o))return{variable:i.variable,argument:o.name,labels:i.labels}},_a=(e,t,n)=>{let r=Ra(t,n.argument),i=e.current?.[n.variable];if(r?.kind!==`Value`||typeof i!=`object`||i.kind!==`Function`)return;let a=i.domain.indexOf(r.value),o=a===-1?void 0:i.range[a];return typeof o==`string`?o:void 0},va=(e,t,n)=>{let r=e.map(e=>Gi(e,t,n)),i=n?[]:e.map(e=>ga(e,t,/* @__PURE__ */ new Set)),a=i.find(e=>e!==void 0),o=i.map(e=>e?.variable===a?.variable&&e?.argument===a?.argument?e?.labels:void 0);return(e,t,n,i,s,c)=>{let l=a&&_a(e,t,a);for(let a=0;a<r.length&&!e.isStopped;a++)(l===void 0||o[a]?.has(l)!==!1)&&r[a](e,t,n,i,s,c)}},ya=(e,t,n)=>{let r=e=>Gi(e,t,n);switch(e.kind){case`And`:return ia(e.operands,t,n);case`Or`:return va(e.operands,t,n);case`Exists`:{let t=r(e.body),n=e.bounds[0];if(e.bounds.length===1&&n.pattern.kind===`Name`){let e=n.pattern.name;return(r,i,a,o,s,c)=>{let l=Ja(X(n.set,K(r,i,a)),n.set);for(let n=0;n<l.length&&!r.isStopped;n++)t(r,za(i,e,l[n]),a,o,s,c)}}return(n,r,i,a,o,s)=>{Ya(e.bounds,K(n,r,i),e=>(t(n,e,i,a,o,s),n.isStopped))}}case`Forall`:{let i=r(e.body),a=!n&&bs(e,t)!==void 0&&!na(e.body,t,/* @__PURE__ */ new Set)?ta(e,ea):void 0;return(t,n,r,o,s,c)=>{let l=[];Ya(e.bounds,K(t,n,r),e=>(l.push(e),!1));let u=[...l.slice(0,1),...l.slice(1).reverse()];if(a?.every(e=>Ra(n,e)?.kind===`Value`)){u.every(n=>Ui(e.body,K(t,n,r)))&&c(r,o);return}let d=(n,r,a)=>{n===u.length?c(r,a):n>0&&t.isInit&&Ca(r)?u.slice(n).every(n=>aa(e.body,K(t,n,r)))&&c(r,a):i(t,u[n],r,a,!0,(e,t)=>d(n+1,e,t))};d(0,r,o)}}case`If`:{let t=r(e.consequent),n=r(e.alternative);return(r,i,a,o,s,c)=>{let l=X(e.condition,K(r,i,a));(Ha(l,`an IF condition`)?t:n)(r,i,a,o,s,c)}}case`Case`:{let t=e.arms.map(e=>({condition:e.condition,body:r(e.body)})),n=e.other?r(e.other):void 0;return(r,i,a,o,s,c)=>{let l=K(r,i,a),u=t.find(e=>Ha(X(e.condition,l),`a CASE guard`))?.body??n;if(!u)throw new f(`No CASE guard is true at ${q(e)}`);u(r,i,a,o,s,c)}}case`Let`:{let n=r(e.body),i=Po(e.definitions,t);return(t,r,a,o,s,c)=>n(t,To(e.definitions,K(t,r,a),i),a,o,s,c)}case`Unchanged`:return n?()=>{throw new f(`UNCHANGED appears in an initial predicate at ${q(e)}`)}:pa(e.expression,t);case`AngleAction`:{let t=r(e.action),n=la(e.subscript);return(e,r,i,a,o,s)=>t(e,r,i,a,o,(t,i)=>{Ui(n,K(e,r,t))||s(t,i)})}case`BoxAction`:return r({kind:`Or`,operands:[e.action,la(e.subscript)],location:e.location});case`Label`:return r(e.body);case`Identifier`:return ha(e,t,n);case`FunctionApplication`:return fa(e,t,n);case`Apply`:{let i=e.args;if(Wi(e.operator)){let r=Ji(i[0],t,n);if(r!==void 0)return e.operator===`=`?ia([e],t,n):sa(e,()=>r);if(Xi(i[0],n))return ua(e,n)}if(e.operator===`=>`){let e=r(i[1]);return(t,n,r,a,o,s)=>{let c=X(i[0],K(t,n,r));(typeof c==`boolean`?c:Ha(c,`the left side of => at ${q(i[0])}`))?e(t,n,r,a,o,s):s(r,a)}}return ma(e,t,n)}default:return oa(e)}},ba=/* @__PURE__ */ new WeakMap,xa=e=>{let t=ba.get(e);if(t)return t;let n=e.variables.map(()=>void 0);return ba.set(e,n),n},Sa=(e,t)=>t.variables.filter((t,n)=>e[n]===void 0),Ca=e=>{for(let t=0;t<e.length;t++)if(e[t]===void 0)return!1;return!0},wa=(e,t)=>{let n=t.state;if(!n||!Ca(n))throw new f(`ENABLED needs a complete state at ${q(e)}`);let r=t.environment,i={value:!1};return Gi(e,r,!1)({environment:r,isInit:!1,current:n,isStopped:!1},t.scope,xa(r),void 0,!1,()=>{i.value=!0}),i.value},Ta=(t,n,r,i)=>{let o={environment:n,isInit:!0,current:void 0,isStopped:!1};Gi(t,n,!0)(o,i,xa(n),void 0,!1,t=>{if(!o.isStopped){if(!Ca(t))throw a(new f(`The initial predicate does not assign ${Sa(t,n).join(`, `)}`),e.error);o.isStopped=r(t)}})},Ea=(e,t,n)=>{let r=[];return Ta(e,t,e=>(r.push(e),!1),n),r},Da=(e,t,n,r,i)=>{let a={environment:n,isInit:!1,current:t,isStopped:!1},o={successors:0};return Gi(e,n,!1)(a,i,xa(n),void 0,!1,(e,t)=>{if(!a.isStopped){if(!Ca(e))throw new f(`Successor state is not completely specified by action ${t??`Next`}. The following variables are not assigned: ${Sa(e,n).join(`, `)}`);o.successors++,a.isStopped=r({state:e,action:t})}}),o.successors},Oa=(e,t,n,r)=>{let i=[];return Da(e,t,n,e=>(i.push(e),!1),r),i},q=e=>`line ${e.location.line}, column ${e.location.column}`,ka=e=>`line ${e.start.line}, col ${e.start.column} to line ${e.end.line}, col ${e.end.column} of module ${e.module}`,Aa=e=>{let t=e.location.range;return t?ka(t):q(e)},ja=(e,t)=>new f(`A non-boolean expression (${Zn(t)}) was used as the condition of an IF.\n${Aa(e)}`),Ma=(e,t,n)=>{let r=e.location.range;if(r?.start.line===e.location.line&&r.start.column===e.location.column||!r){let r=e.operands[t],i=r.kind===`Number`?String(r.value):Aa(r);return new f(`A non-boolean expression (${Zn(n)}) was used as a formula in a conjunction.\n${i}`)}let i=e.operands[Math.max(t,1)].location.range?.end??r.end;return new f(`Attempted to evaluate an expression of form P /\\ Q when ${t===0?`P`:`Q`} was\n${Zn(n)}.\n${Aa({...e,location:{...e.location,range:{...r,end:i}}})}`)},Na=e=>t=>`Attempted to select nonexistent field "${e.field}" from the record\n${H(t)}\n${Aa(e)}`,Pa=e=>t=>{if(!k(t))throw new f(`Attempted to apply the operator DOMAIN to a non-function\n(${Zn(t)})\n${Aa(e)}`);return en(t)},Fa=(e,t)=>(n,r)=>{if(!O(n)||N(n))throw new f(`Attempted to evaluate an expression of form S \\subseteq T, but S was not enumerable.\n${Aa(e)}`);return t.evaluate([n,r])},Ia=t=>a(new f(`TLC can't handle real numbers: ${t.text} at ${q(t)}`),e.configParseError),La=t=>a(new f(`TLC can't handle a number this big: ${t.text??t.value} at ${q(t)}`),e.error),Ra=(e,t)=>{for(let n=e;n;n=n.parent)if(n.name===t)return n.binding},za=(e,t,n)=>({name:t,binding:{kind:`Value`,value:n},parent:e}),Ba=(e,t,n)=>{if(t.kind===`Name`)return za(e,t.name,n);let r=qt(n);if(!r||r.length!==t.names.length)throw new f(`Cannot bind <<${t.names.join(`, `)}>> to ${H(n)}, which is not a tuple of that length`);return t.names.reduce((e,t,n)=>za(e,t,r[n]),e)},Va=(e,t)=>({environment:e.environment,scope:t,state:e.state,next:e.next}),Ha=(e,t)=>{if(typeof e!=`boolean`)throw new f(`Expected ${t} to be a boolean but found ${H(e)}`);return e},Ua=e=>{switch(e.kind){case`Number`:case`Decimal`:case`String`:case`Identifier`:case`OperatorReference`:case`ExceptAt`:return[];case`Apply`:return e.args;case`Lambda`:return[e.body];case`And`:case`Or`:return e.operands;case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return[e.expression];case`If`:return[e.condition,e.consequent,e.alternative];case`Case`:return[...e.arms.flatMap(e=>[e.condition,e.body]),...e.other?[e.other]:[]];case`Let`:return[...e.definitions.flatMap(e=>e.kind===`Function`?[...e.bounds.map(e=>e.set),e.body]:[e.body]),e.body];case`Forall`:case`Exists`:return[...e.bounds.map(e=>e.set),e.body];case`UnboundedQuantifier`:return[e.body];case`Choose`:return[...e.set?[e.set]:[],e.body];case`SetEnumeration`:case`Tuple`:return e.elements;case`SetFilter`:return[e.bound.set,e.predicate];case`SetMap`:return[e.expression,...e.bounds.map(e=>e.set)];case`FunctionConstruction`:return[...e.bounds.map(e=>e.set),e.body];case`FunctionSet`:return[e.domain,e.range];case`Record`:case`RecordSet`:return e.fields.map(e=>e.value);case`Except`:return[e.function,...e.updates.flatMap(e=>[...e.path.flatMap(e=>e.kind===`Index`?e.args:[]),e.value])];case`FunctionApplication`:return[e.function,...e.args];case`FieldAccess`:return[e.record];case`Product`:return e.factors;case`BoxAction`:case`AngleAction`:return[e.action,e.subscript];case`WeakFairness`:case`StrongFairness`:return[e.subscript,e.action];case`Label`:return[e.body];case`Subexpression`:return e.selectors.flatMap(e=>`args`in e?e.args:[])}},J=e=>(e.kind===`Identifier`||e.kind===`Apply`)&&e.resolution?.kind===`Local`,Wa=(e,t)=>t.definitions.get(t.substitutions.get(e)??e),Ga=(e,t)=>{if(e.kind===`Prime`||e.kind===`Unchanged`||e.kind===`Enabled`)return!0;let n=e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0;if(n!==void 0){if(t.variableIndex.has(n)||t.builtins.get(n)?.isStateLevel)return!0;let e=Wa(n,t);if(e&&!t.constants.has(n)&&!Ka(e,t))return!0}return Ua(e).some(e=>Ga(e,t))},Ka=(e,t)=>{let n=t.constantLevels.get(e);if(n!==void 0)return n;t.constantLevels.set(e,!0);let r=!Ga(e.body,t)&&(e.kind===`Operator`||!e.bounds.some(e=>Ga(e.set,t)));return t.constantLevels.set(e,r),r},qa=(e,t)=>{let n=`universally (\\A) or existentially (\\E) quantify over ${t}, because this would require checking an\ninfinite number of cases.`;if(typeof e==`object`&&e.kind===`SequenceSet`)return`In TLA+, Seq(S) represents the set of all finite sequences whose elements come from the set S. Even when S\nis a finite set, the number of possible sequences in Seq(S) is unbounded because sequences can have any\nfinite length (e.g., length 0, 1, 2, and so on). As a result, TLC cannot evaluate expressions that\n${n} Note that for a finite set of sequences s, TLC handles s \\subseteq Seq(S).\nSee https://explain.tlapl.us/seq-unenumerable for additional details.`;if(typeof e==`object`&&e.kind===`InfiniteSet`&&e.name!==`STRING`&&e.name!==`Any`)return`The set ${e.name} contains infinitely many elements. As a result, TLC cannot evaluate expressions that\n${n} Note that TLC handles set membership like T \\subseteq ${e.name} for any finite set T.`},Ja=(e,t)=>{if(!O(e)||N(e)){let n=H(e),r=qa(e,n);throw new f(r===void 0?`TLC encountered a non-enumerable quantifier bound\n${n}.\n${Aa(t)}`:`TLC encountered the non-enumerable quantifier bound\n${n}\n${Aa(t)}\n${r}`)}return typeof e==`object`&&e.kind===`Interval`?Tt(e):R(e).elements},Ya=(e,t,n)=>{let r=e.map(e=>Ja(X(e.set,t),e.set)),i=(t,a)=>t<0?n(a):r[t].some(n=>i(t-1,Ba(a,e[t].pattern,n)));return i(e.length-1,t.scope)},Xa=(e,t)=>{let n=e.map(e=>X(e.set,t));return n.length===1?n[0]:{kind:`ProductSet`,factors:n}},Za=(e,t,n)=>{if(e.length===1)return Ba(t,e[0].pattern,n);let r=qt(n)??[];return e.reduce((e,t,n)=>Ba(e,t.pattern,r[n]),t)},Qa=/* @__PURE__ */ new WeakMap,$a=(e,t)=>{let n=Qa.get(t);if(n)return n;let r=t.location.range;if(!r)return;let i={parameters:e.flatMap((t,n)=>n>0&&e[n-1].set===t.set?[]:[{index:n,name:t.pattern.kind===`Name`?t.pattern.name:`<<${t.pattern.names.join(`, `)}>>`}]),body:ka(r)};return Qa.set(t,i),i},eo=(e,t,n)=>{let r=$a(e,t);if(!r)return;let i=e.length>1&&typeof n==`object`&&n.kind===`ProductSet`?n.factors:[n];return{parameters:r.parameters.map(e=>({name:e.name,domain:i[e.index]})),body:r.body}},to=(e,t,n)=>{let r=/* @__PURE__ */ new Map,i={kind:`LazyFunction`,domain:e,source:n,apply:e=>{let n=un(e),a=r.get(n);if(a!==void 0){for(let t=0;t<a.length;t+=2)if(Be(a[t],e))return a[t+1]}let o=t(e,i),s=r.get(n);return s===void 0?r.set(n,[e,o]):s.push(e,o),o}};return i},no=(e,t)=>{let n=Xa(e.bounds,t),r=to(n,(n,r)=>X(e.body,Va(t,Za(e.bounds,za(void 0,e.name,r),n))),eo(e.bounds,e.body,n));return e.bounds.length===1?Zt(r):r},ro=(e,t)=>e.kind===`Function`?no(e,t):X(e.body,t),io=(e,t)=>{let n=Ka(e,t.environment),r=n?t.environment.definitionValues.get(e):void 0;if(r!==void 0)return r;if(e.kind===`Operator`&&e.params.length>0)throw new f(`Operator ${e.name} requires ${e.params.length} arguments`);let i=Va(t,void 0);if(!n)return ro(e,i);let a=t.environment.runtime.evaluateAtStartup(()=>ro(e,i));return t.environment.definitionValues.set(e,a),a},ao=(e,t)=>{let n=e.state===t.state&&e.next===t.next;if(n&&e.cache!==void 0)return e.cache;let r=X(e.expression,Va(t,e.scope));return n&&(e.cache=r),r},oo=/* @__PURE__ */ new WeakMap,so=e=>{let t=oo.get(e);if(t)return t;let n={kind:`Closure`,name:e.name,params:e.params,body:e.body,scope:void 0};return oo.set(e,n),n},co=(e,t)=>{let n=t.substitutions.get(e);if(n!==void 0)return co(n,t);let r=t.definitions.get(e);return r?.kind===`Operator`?so(r):t.builtins.get(e)},lo=/* @__PURE__ */ new WeakMap,uo=(e,t)=>{if(J(e))return fo(e.operator,t);let n=lo.get(e),r=n===void 0?co(e.operator,t.environment)??null:n;return n===void 0&&lo.set(e,r),r??fo(e.operator,t)},fo=(e,t)=>{let n=Ra(t.scope,e);if(n?.kind===`Operator`)return n.operator;if(!n)return co(e,t.environment)},po=e=>e.kind===`Closure`?e.params.length:e.arity,mo=(e,t)=>{if(e.kind===`Lambda`)return{kind:`Closure`,name:`LAMBDA`,params:e.params.map(e=>({name:e,arity:0})),body:e.body,scope:t.scope};let n=e.kind===`OperatorReference`?e.operator:e.kind===`Identifier`?e.name:void 0,r=n===void 0?void 0:fo(n,t);if(!r)throw new f(`Expected an operator argument at ${q(e)}`);return r},ho=(e,t,n)=>{if(e.kind===`Builtin`)return e.evaluate(t,n);if(e.kind===`Operator`)return e.call(t);let r=e.params.reduce((e,n,r)=>za(e,n.name,t[r]),e.scope);return X(e.body,Va(n,r))},go=(e,t)=>e.kind===`Operator`?e:{kind:`Operator`,name:e.name,arity:po(e),call:n=>ho(e,n,t),literalBody:e.kind===`Closure`&&(e.body.kind===`Number`||e.body.kind===`String`)?e.body.value:void 0},_o=(e,t)=>{if(e.kind===`Lambda`||e.kind===`OperatorReference`)return!0;if(e.kind!==`Identifier`)return!1;let n=fo(e.name,t);return n!==void 0&&po(n)>0},vo=(e,t)=>({kind:`Thunk`,expression:e,scope:t.scope,state:t.state,next:t.next,cache:void 0}),yo=(e,t)=>{let n=t.variableIndex.get(e);if(n!==void 0)return{kind:`Variable`,index:n};let r=t.constants.get(e);if(r!==void 0)return{kind:`Value`,value:r};let i=t.substitutions.get(e);if(i!==void 0)return yo(i,t);let a=t.definitions.get(e);if(a)return{kind:`Definition`,definition:a};let o=t.builtins.get(e);if(o&&o.arity===0&&!o.isStateLevel)return{kind:`Value`,value:o.evaluate([])}},bo=(e,t)=>{if(e.kind===`String`||e.kind===`Number`&&Do(e.value)){let t={kind:`Value`,value:e.value};return()=>t}if(e.kind===`Identifier`){let n=J(e)?void 0:yo(e.name,t);if(n?.kind===`Value`){let e={kind:`Value`,value:n.value};return()=>e}if(n===void 0)return t=>{let n=Ra(t.scope,e.name);return n?.kind===`Value`?n:vo(e,t)}}return t=>vo(e,t)},xo=/* @__PURE__ */ new WeakMap,So=(e,t)=>{let n=xo.get(e);if(n)return n;let r=bo(e,t);return xo.set(e,r),r},Co=(e,t,n)=>{if(t.length!==e.params.length)throw new f(`Operator ${e.name} expects ${e.params.length} arguments but received ${t.length}`);let r=e.scope;for(let i=0;i<t.length;i++){let a=e.params[i],o=a.arity>0?{kind:`Operator`,operator:mo(t[i],n)}:So(t[i],n.environment)(n);r={name:a.name,binding:o,parent:r}}return r},wo=(e,t,n)=>e.kind===`Closure`?X(e.body,Va(n,Co(e,t,n))):e.kind===`Operator`?e.call(t.map(e=>X(e,n))):e.isLazy?e.evaluate($o(t,n),n):e.evaluate(t.map(e=>_o(e,n)?go(mo(e,n),n):X(e,n)),n),To=(e,t,n)=>e.reduce((e,r)=>{let i={name:r.name,binding:{kind:`Value`,value:!1},parent:e};return r.kind===`Function`?(i.binding={kind:`Thunk`,expression:{kind:`FunctionConstruction`,bounds:r.bounds,body:r.body,location:r.location,isRecursive:!0},scope:i,state:t.state,next:t.next,cache:void 0},i):r.params.length>0||n?.has(r)?(i.binding={kind:`Operator`,operator:{kind:`Closure`,name:r.name,params:r.params,body:r.body,scope:i}},i):(i.binding={kind:`Thunk`,expression:r.body,scope:i,state:t.state,next:t.next,cache:void 0},i)},t.scope),Eo=(e,t,n)=>{let r=Ra(n.scope,e);if(r?.kind===`Value`)return r.value;if(r?.kind===`Thunk`)return ao(r,n);if(r?.kind===`Operator`){if(po(r.operator)===0)return ho(r.operator,[],n);throw new f(`Operator ${e} is used without arguments`)}let i=yo(e,n.environment);if(i?.kind===`Variable`){let r=n.state?.[i.index];if(r===void 0)throw new f(`The variable ${e} is not assigned at ${q(t)}`);return r}if(i?.kind===`Value`)return i.value;if(i?.kind===`Definition`)return io(i.definition,n);let a=n.environment.builtins.get(e);if(a?.arity===0)return a.evaluate([],n);throw new f(`Unknown identifier ${e} at ${q(t)}`)},Do=e=>Number.isInteger(e)&&e<=2147483647&&e>=-2147483648,Oo=/* @__PURE__ */ new Set([`Print`,`PrintT`,`Assert`,`JavaTime`,`RandomElement`,`TLCGet`,`TLCSet`]),ko=(e,t)=>Oo.has(e)||t.builtins.get(e)?.isStateLevel===!0,Ao=/* @__PURE__ */ new WeakMap,jo=(e,t)=>e.kind===`Operator`&&e.params.length===0&&Ka(e,t),Mo=(e,t)=>{let n=e.kind===`Identifier`?e.name:e.kind===`Apply`||e.kind===`OperatorReference`?e.operator:void 0;if(n!==void 0&&!J(e)){let e=Wa(n,t);if(!e&&ko(n,t)||e&&!jo(e,t)&&No(e,t))return!0}return Ua(e).some(e=>Mo(e,t))},No=(e,t)=>{let n=Ao.get(e);if(n!==void 0)return n;Ao.set(e,!1);let r=Mo(e.body,t)||e.kind===`Function`&&e.bounds.some(e=>Mo(e.set,t));return Ao.set(e,r),r},Po=(e,t)=>new Set(e.filter(e=>No(e,t))),Fo=e=>[...e.definitions.values()].some(t=>No(t,e)),Io=/* @__PURE__ */ new WeakMap,Lo=(e,t)=>{let n=Io.get(e);if(n!==void 0)return n;let r=Vo(e,t,zo);return Io.set(e,r),r},Ro=/* @__PURE__ */ new Set([`Number`,`String`,`Identifier`,`Apply`,`And`,`Or`,`If`,`Case`,`SetEnumeration`,`Tuple`,`FunctionSet`,`Record`,`RecordSet`,`FunctionApplication`,`FieldAccess`,`Product`,`SetFilter`,`SetMap`,`Forall`,`Exists`,`Choose`,`FunctionConstruction`,`Let`]),zo=/* @__PURE__ */ new Set,Bo=(e,t,n)=>n.size===0?Lo(e,t):Vo(e,t,n),Vo=(e,t,n)=>{if(!Ro.has(e.kind))return!1;if(e.kind===`Identifier`&&J(e))return n.has(e.name);if(J(e))return!1;if(e.kind===`Identifier`){let n=yo(e.name,t);return n?.kind===`Value`||n?.kind===`Definition`&&jo(n.definition,t)}if(e.kind===`Apply`){if(ko(e.operator,t)||e.operator===`~>`)return!1;let r=co(e.operator,t);if(r?.kind!==`Builtin`&&r?.kind!==`Closure`)return!1;if(r.kind===`Closure`){let n=Wa(e.operator,t);if(!n||!Ka(n,t)||No(n,t))return!1}return!(r.kind===`Closure`?r.params:[]).some(e=>e.arity>0)&&e.args.every(e=>e.kind!==`Lambda`&&e.kind!==`OperatorReference`&&Bo(e,t,n))}let r={value:!0};return mi(e,(e,i)=>(r.value&&=Bo(e,t,i.length===0?n:/* @__PURE__ */ new Set([...n,...i])),e)),r.value},Ho=e=>e.kind!==`Number`&&e.kind!==`String`&&e.kind!==`Identifier`,Uo=e=>{let t={value:void 0};return n=>{if(t.value!==void 0)return t.value;let r=e(n);return t.value=r,r}},Wo=(e,t)=>{if(e.kind===`Identifier`&&J(e))return!t.has(e.name);if(J(e))return!0;let n={value:!1};return mi(e,(e,r)=>(n.value||=Wo(e,r.length===0?t:/* @__PURE__ */ new Set([...t,...r])),e)),n.value},Go=(e,t)=>oi.has(e)&&Ho(e)&&bs(e,t)!==void 0&&!Wo(e,zo),Y=(e,t)=>{let n=t.evaluators.get(e);if(n)return n;let r=_s(e,t),i=Ho(e)&&Lo(e,t)?Uo(r):Go(e,t)?Xo(r):r;return t.evaluators.set(e,i),i},Ko=/* @__PURE__ */ new WeakMap,qo=(e,t)=>{let n=Ko.get(e);if(n)return n;let r=(Ho(e)&&Lo(e,t)?void 0:_r(e,t))??Y(e,t);return Ko.set(e,r),r},X=(e,t)=>qo(e,t.environment)(t),Jo=(e,t)=>{let n=e.name,r=J(e)?void 0:yo(n,t);if(r?.kind===`Variable`){let t=r.index;return r=>{let i=r.state?.[t];if(i===void 0)throw new f(`The variable ${n} is not assigned at ${q(e)}`);return i}}if(r?.kind===`Value`){let e=r.value;return()=>e}if(r?.kind===`Definition`&&r.definition.kind===`Operator`){let e=r.definition;if(e.params.length===0&&Ka(e,t))return t=>io(e,t);if(e.params.length===0){let n={body:void 0},r=r=>(n.body??=qo(e.body,t),n.body(Va(r,void 0)));return Yo(e,t)?Xo(r):r}return t=>io(e,t)}if(r?.kind===`Definition`){let e=r.definition,n=t=>io(e,t);return Ka(e,t)||!Yo(e,t)?n:Xo(n)}return t=>Eo(n,e,t)},Yo=(e,t)=>bs(e.body,t)!==void 0&&(e.kind===`Operator`||e.bounds.every(e=>bs(e.set,t)!==void 0)),Xo=e=>{let t={recent:void 0,recentValue:void 0,previous:void 0,previousValue:void 0};return n=>{let r=n.state;if(r!==void 0&&t.recent===r&&t.recentValue!==void 0)return t.recentValue;if(r!==void 0&&t.previous===r&&t.previousValue!==void 0)return t.previousValue;let i=e(n);return t.previous=t.recent,t.previousValue=t.recentValue,t.recent=r,t.recentValue=i,i}},Zo=(e,t)=>{let n=co(e,t);return n!==void 0&&po(n)>0},Qo=(e,t)=>e.kind!==`Lambda`&&e.kind!==`OperatorReference`&&!(e.kind===`Identifier`&&!J(e)&&Zo(e.name,t)),$o=(e,t)=>e.map(e=>({kind:`Operator`,name:`argument`,arity:0,call:()=>X(e,t),expression:e})),es=(e,t,n)=>{if(e.isLazy)return n=>e.evaluate($o(t,n),n);let r=e.evaluateUnary;if(r&&t.length===1&&Qo(t[0],n)){let e=Y(t[0],n);return t=>r(e(t))}let i=e.evaluateBinary,a=t.length===2&&Qo(t[0],n)&&Qo(t[1],n);if(i&&a){let e=Y(t[0],n),r=Y(t[1],n);return t=>i(e(t),r(t))}return n=>e.evaluate(t.map(e=>_o(e,n)?go(mo(e,n),n):X(e,n)),n)},ts=(e,t,n)=>{if(t.length!==e.params.length)return()=>{throw new f(`Operator ${e.name} expects ${e.params.length} arguments but received ${t.length}`)};let r=e.params,i=t.map((e,t)=>r[t].arity>0?void 0:So(e,n));return n=>{let a=e.scope;for(let e=0;e<t.length;e++){let o=i[e],s=o?o(n):{kind:`Operator`,operator:mo(t[e],n)};a={name:r[e].name,binding:s,parent:a}}return a}},ns=/* @__PURE__ */ new WeakMap,rs=e=>{let t=ns.get(e);if(t)return t;let n={calls:/* @__PURE__ */ new Map,size:0};return ns.set(e,n),n},is=(e,t)=>{let n=[];for(let r=e;n.length<t;r=r?.parent){if(r?.binding.kind!==`Value`)return;n.push(r.binding.value)}return n},as=(e,t)=>e.every((e,n)=>Be(e,t[n])),os=(e,t)=>{let n=Wa(e.operator,t);return n?.kind===`Operator`&&n.params.length>0&&n.params.every(e=>e.arity===0)&&Ka(n,t)&&!No(n,t)},ss=(e,t,n,r)=>{let i=ts(e,t,n),a={body:void 0},o=(t,r)=>(a.body??=qo(e.body,n),a.body({environment:n,scope:t,state:r.state,next:r.next}));if(!r)return e=>o(i(e),e);let s=rs(e);return e=>{let n=i(e),r=is(n,t.length);if(!r)return o(n,e);let a=r.length;for(let e of r)a=an(a,un(e));let c=s.calls.get(a),l=c?.find(e=>as(e.args,r));if(l)return l.value;let u=o(n,e);return s.size<65536&&(s.size++,c?c.push({args:r,value:u}):s.calls.set(a,[{args:r,value:u}])),u}},cs=(e,t)=>{let n=e.args;if(e.operator===`=>`){let e=Y(n[0],t),r=Y(n[1],t);return t=>!Ha(e(t),`the left side of =>`)||Ha(r(t),`the right side of =>`)}if(e.operator===`~>`)return()=>{throw new f(`TLC cannot evaluate a temporal formula such as ~> in a state`)};let r=J(e)?void 0:co(e.operator,t);if(r?.kind===`Closure`)return ss(r,n,t,os(e,t));if(r?.kind===`Builtin`&&r.name===`DOMAIN`){let r=Y(n[0],t),i=Pa(e);return e=>i(r(e))}if(r?.kind===`Builtin`&&r.name===`TLCEval`&&n.length===1){let i=Y(n[0],t);return si.has(e)||Ga(n[0],t)?i:e=>e.scope===void 0?r.evaluate([i(e)]):i(e)}if(r?.kind===`Builtin`&&r.name===`\\subseteq`&&n.length===2){let i=Y(n[0],t),a=Y(n[1],t),o=Fa(e,r);return e=>o(i(e),a(e))}return r?.kind===`Builtin`?es(r,n,t):r=>{let i=fo(e.operator,r);if(i)return wo(i,n,r);throw t.definitions.get(e.operator)?.kind===`Function`?new f(`${e.operator} is a function; apply it with brackets`):new f(`Unknown operator ${e.operator} at ${q(e)}`)}},ls=(e,t)=>{let n=e.kind===`Forall`,r=n?`the body of \\A`:`the body of \\E`,i=Y(e.body,t),a=e.bounds[0];if(e.bounds.length===1&&a.pattern.kind===`Name`){let e=a.pattern.name,o=Y(a.set,t);return t=>{let s=Ja(o(t),a.set);for(let a=0;a<s.length;a++){let o=Ha(i(Va(t,za(t.scope,e,s[a]))),r);if(o!==n)return o}return n}}let o=e.bounds;if(o.every(e=>e.pattern.kind===`Name`)){let e=o.map(e=>e.pattern.kind===`Name`?e.pattern.name:``),a=o.map(e=>Y(e.set,t));return t=>{let s=a.map((e,n)=>Ja(e(t),o[n].set)),c=(a,o)=>{if(a<0)return Ha(i(Va(t,o)),r)!==n;let l=s[a];for(let t=0;t<l.length;t++)if(c(a-1,za(o,e[a],l[t])))return!0;return!1};return c(o.length-1,t.scope)?!n:n}}return e=>Ya(o,e,t=>Ha(i(Va(e,t)),r)!==n)?!n:n},us=(e,t)=>{if(e.kind===`Tuple`)return I(e.names.map(e=>{let n=Ra(t,e);return n?.kind===`Value`&&n.value}));let n=Ra(t,e.name);return n?.kind===`Value`?n.value:void 0},ds=/* @__PURE__ */ new WeakSet,fs=e=>{(e.kind===`FunctionConstruction`||e.kind===`Except`)&&ds.add(e)},ps=(e,t)=>{let n=ds.has(e),r=Y(e.body,t),i=e.bounds,a=i[0],o=i.length===1&&a.pattern.kind===`Name`,s=Y(a.set,t);return t=>{let c=o?s(t):Xa(i,t);if(e.isRecursive||n||!L(c)){let n=to(c,e=>r(Va(t,Za(i,t.scope,e))),eo(i,e.body,c));return i.length===1?Zt(n):n}if(o&&a.pattern.kind===`Name`){let e=a.pattern.name,n=Dt(c);return Zt(F(n,n.map(n=>r(Va(t,za(t.scope,e,n))))))}let l=[];return Ya(i,t,e=>{let n=i.length===1?us(a.pattern,e)??!1:I(i.map(t=>us(t.pattern,e)??!1));return l.push([n,r(Va(t,e))]),!1}),yt(l)}},ms=(e,t)=>{let n=ds.has(e);n&&fs(e.function);let r=Y(e.function,t),i=e.updates.map(e=>({path:e.path.map(e=>e.kind===`Field`?{kind:`Field`,name:e.name,args:[]}:{kind:`Index`,name:``,args:e.args.map(e=>Y(e,t))}),value:Y(e.value,t)})),a=(e,t)=>e.kind===`Field`?e.name:e.args.length===1?e.args[0](t):I(e.args.map(e=>e(t))),o=(e,t,r,i,s)=>r===t.length?s(Va(i,za(i.scope,`@`,e))):tn(e,a(t[r],i),e=>o(e,t,r+1,i,s),n&&r===0);return e=>{let t=r(e);for(let n of i)t=o(t,n.path,0,e,n.value);return t}},hs=(e,t)=>{if(e.kind===`SetFilter`){let n=Y(e.predicate,t),r=Y(e.bound.set,t),i=e.bound.pattern;return t=>{let a=r(t),o=e=>Ha(n(Va(t,Ba(t.scope,i,e))),`a set filter predicate`);if(typeof a!=`object`||a.kind!==`Set`&&a.kind!==`MixedSet`&&a.kind!==`Interval`){if(O(a))return{kind:`FilteredSet`,base:a,test:o};throw new f(`TLC encountered a non-enumerable quantifier bound ${H(a)} at ${q(e.bound.set)}`)}return Le(R(a).elements.filter(o))}}if(e.kind===`SetMap`){let n=Y(e.expression,t);return t=>{let r=[];return Ya(e.bounds,t,e=>(r.push(n(Va(t,e))),!1)),mt(r)}}let n=e.set;if(!n)return()=>{throw new f(`TLC cannot evaluate an unbounded CHOOSE at ${q(e)}`)};let r=Y(e.body,t),i={pattern:e.pattern,set:n};return t=>{let n={value:void 0};if(Ya([i],t,i=>Ha(r(Va(t,i)),`the body of CHOOSE`)?(n.value=us(e.pattern,i),!0):!1),n.value===void 0)throw new f(`Attempted to compute the value of an expression of form\nCHOOSE x \\in S: P, but no element of S satisfied P.\n${Aa(e)}`);return n.value}},gs=(e,t)=>{let n=[...e].sort((e,t)=>P(e.name,t.name)),r=n.some((e,t)=>t>0&&n[t-1].name===e.name),i=n.map(e=>Y(e.value,t));if(r)return e=>yt(n.map((t,n)=>[t.name,i[n](e)]));let a=n.map(e=>e.name),o=e.map(e=>e.name);return o.some((e,t)=>e!==a[t])?e=>ve(a,i.map(t=>t(e)),o):e=>F(a,i.map(t=>t(e)))},_s=(e,t)=>{let n=e=>Y(e,t);switch(e.kind){case`Number`:{let t=e.value;return Do(t)?()=>t:()=>{throw La(e)}}case`Decimal`:return()=>{throw Ia(e)};case`String`:{let t=e.value;return()=>t}case`Identifier`:return Jo(e,t);case`Apply`:return cs(e,t);case`OperatorReference`:case`Lambda`:return()=>{throw new f(`An operator cannot be used as a value at ${q(e)}`)};case`And`:{let t=e.operands.map(n);return n=>{for(let r=0;r<t.length;r++){let i=t[r](n);if(typeof i!=`boolean`)throw Ma(e,r,i);if(!i)return!1}return!0}}case`Or`:{let t=e.operands.map(n);return e=>{for(let n=0;n<t.length;n++)if(Ha(t[n](e),`a disjunct`))return!0;return!1}}case`Prime`:{let t=n(e.expression);return n=>{if(!n.next)throw new f(`A primed expression appears outside an action at ${q(e)}`);return t({environment:n.environment,scope:n.scope,state:n.next,next:void 0})}}case`Unchanged`:{let t=n({kind:`Prime`,expression:e.expression,location:e.location}),r=n(e.expression);return e=>Re(t(e),r(e))}case`If`:{let t=n(e.condition),r=n(e.consequent),i=n(e.alternative);return n=>{let a=t(n);if(typeof a!=`boolean`)throw ja(e,a);return a?r(n):i(n)}}case`Case`:{let t=e.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),r=e.other?n(e.other):void 0;return n=>{for(let e of t)if(Ha(e.condition(n),`a CASE guard`))return e.body(n);if(r)return r(n);throw new f(`No CASE guard is true at ${q(e)}`)}}case`Let`:{let t=n(e.body);return n=>t(Va(n,To(e.definitions,n)))}case`Forall`:case`Exists`:return ls(e,t);case`UnboundedQuantifier`:return()=>{throw new f(`TLC cannot evaluate an unbounded quantifier at ${q(e)}`)};case`Choose`:case`SetFilter`:case`SetMap`:return hs(e,t);case`SetEnumeration`:{let t=e.elements.map(n);return e=>mt(t.map(t=>t(e)))}case`Tuple`:{let t=e.elements.map(n);return e=>I(t.map(t=>t(e)))}case`FunctionConstruction`:return ps(e,t);case`FunctionSet`:{let t=n(e.domain),r=n(e.range);return e=>({kind:`FunctionSet`,domain:t(e),range:r(e)})}case`Record`:return gs(e.fields,t);case`RecordSet`:{let t=[...e.fields].sort((e,t)=>P(e.name,t.name)),r=t.map(e=>e.name),i=t.map(e=>n(e.value));return e=>({kind:`RecordSet`,names:r,sets:i.map(t=>t(e))})}case`Except`:return ms(e,t);case`ExceptAt`:return t=>{let n=Ra(t.scope,`@`);if(n?.kind!==`Value`)throw new f(`@ appears outside an EXCEPT at ${q(e)}`);return n.value};case`FunctionApplication`:{fs(e.function);let t=n(e.function),r=e.args.map(n);if(r.length===1){let e=r[0];return n=>$t(t(n),e(n))}return e=>$t(t(e),I(r.map(t=>t(e))))}case`FieldAccess`:{let t=n(e.record),r=e.field,i=Na(e);return e=>$t(t(e),r,i)}case`Product`:{let t=e.factors.map(n);return e=>({kind:`ProductSet`,factors:t.map(t=>t(e))})}case`BoxAction`:case`AngleAction`:{let t=n(e.action),r=n({kind:`Unchanged`,expression:e.subscript,location:e.location}),i=e.kind===`BoxAction`;return e=>i?Ha(t(e),`an action`)||r(e):Ha(t(e),`an action`)&&!r(e)}case`Enabled`:{let t=e.expression;return e=>wa(t,e)}case`Label`:return n(e.body);case`Subexpression`:return()=>{throw new f(`The subexpression reference at ${q(e)} does not name a subexpression`)};case`Always`:case`Eventually`:case`WeakFairness`:case`StrongFairness`:return()=>{throw new f(`TLC cannot evaluate a temporal formula in a state at ${q(e)}`)}}},vs=/* @__PURE__ */ new Set([`Prime`,`Unchanged`,`Enabled`,`Always`,`Eventually`,`BoxAction`,`AngleAction`,`WeakFairness`,`StrongFairness`]),ys=e=>{if(e.kind===`Identifier`)return e.name;if(e.kind===`Apply`||e.kind===`OperatorReference`)return e.operator},bs=(e,t)=>{let n=/* @__PURE__ */ new Set,r=/* @__PURE__ */ new Set,i=e=>{if(vs.has(e.kind))return!1;let a=ys(e),o=(e.kind===`Identifier`||e.kind===`Apply`)&&e.resolution?.kind===`Local`;if(a!==void 0&&!o&&!t.constants.has(a)){let e=t.substitutions.get(a)??a,o=t.definitions.get(e);if(!o&&ko(e,t))return!1;let s=t.variableIndex.get(a);if(s!==void 0&&n.add(s),o&&!r.has(o)&&(r.add(o),!i(o.body)||o.kind!==`Operator`&&!o.bounds.every(e=>i(e.set))))return!1}return Ua(e).every(i)};return i(e)?[...n]:void 0},xs=/* @__PURE__ */ new Map([[`Reals`,`-------------------------------- MODULE Reals -------------------------------
+(***************************************************************************)
+(* This module provides dummy definitions of the operators that are        *)
+(* defined by the real Reals module.  It is expected that any tool that    *)
+(* handles specifications that use real numbers will provide its own       *)
+(* implementations of these operators.  TLC currently does not handle real *)
+(* numbers and produces an error if a specification requires TLC to        *)
+(* evaluate the operators defined here or to evaluate any operator defined *)
+(* in the Integers module that is applied to non-integer real numbers.     *)
+(*                                                                         *)
+(* See the book "Specifying Systems" for the real Reals module.            *)
+(***************************************************************************)
 EXTENDS Integers
 
-Real == "Reals"
+Real  == "Reals"
+a / b == CHOOSE m \\in Real : m * b = a
+Infinity == CHOOSE i : (i \\notin Real) /\\ (\\A r \\in Real : i > r)
+=============================================================================`],[`RealTime`,`----------------------------- MODULE RealTime -------------------------------
+(***************************************************************************)
+(* This standard module is described in Chapter 9 of the book "Specifying  *)
+(* Systems".  The type of specification described there cannot be handled  *)
+(* by the TLC model checker.                                               *)
+(***************************************************************************)
+EXTENDS Reals 
+VARIABLE now
 
-a / b == CHOOSE quotient \\in Real : quotient * b = a
+RTBound(A, v, D, E) == 
+  LET TNext(t)  ==  t' = IF <<A>>_v \\/ ~(ENABLED <<A>>_v)'
+                           THEN 0 
+                           ELSE t + (now'-now)
 
-Infinity == CHOOSE value : (value \\notin Real) /\\ (\\A real \\in Real : value > real)
-====`],[`RealTime`,`---- MODULE RealTime ----
-EXTENDS Reals
+      Timer(t) == (t=0)  /\\  [][TNext(t)]_<<t, v, now>>
 
-VARIABLE now
+      MaxTime(t) == [](t \\leq E) 
+
+      MinTime(t) == [][A => t \\geq D]_v 
+  IN \\EE t : Timer(t) /\\ MaxTime(t) /\\ MinTime(t)
+-----------------------------------------------------------------------------
+RTnow(v) == LET NowNext == /\\ now' \\in {r \\in Real : r > now} 
+                           /\\ UNCHANGED v
+            IN  /\\ now \\in Real 
+                /\\ [][NowNext]_now
+                /\\ \\A r \\in Real : WF_now(NowNext /\\ (now'>r))
+=============================================================================`],[`Toolbox`,`----------------------------- MODULE Toolbox --------------------------------
+(***************************************************************************)
+(*                                                                         *)
+(***************************************************************************)
+LOCAL INSTANCE Naturals   \\* a + b
+LOCAL INSTANCE FiniteSets \\* Cardinality
+LOCAL INSTANCE TLC        \\* TLCGet
+
+-----------------------------------------------------------------------------
+
+(* Trace Exploration *)
+
+_TETrace ==
+    CHOOSE f \\in [ (Nat \\ {0}) -> STRING ] : TRUE
 
+LOCAL _TETraceLength == Cardinality(DOMAIN _TETrace)
+
+\\* When evaluated as part of a TLC ALIAS expression, \`_TEPosition\` should be
+\\* redefined as \`TLCGet("level"), or replace with \`TLCGet(level)\` right away.
+\\* The definition below accounts for several "peculiarities" of the
+\\* Toolbox's trace exploration.
+_TEPosition == 
+    IF TLCGet("level") >= _TETraceLength
+       THEN _TETraceLength
+       ELSE IF TLCGet("level") = 0 THEN 1 ELSE TLCGet("level")
+
+=============================================================================`]]),Ss=`tlc2/value/impl/`,Cs=e=>{let t=new DataView(e.buffer,e.byteOffset,e.byteLength),n={offset:0},r=e=>{let t=n.offset;return n.offset+=e,t};return{readUint8:()=>t.getUint8(r(1)),readUint16:()=>t.getUint16(r(2)),readUint32:()=>t.getUint32(r(4)),readInt32:()=>t.getInt32(r(4)),readBytes:t=>e.subarray(r(t),n.offset)}},ws=e=>[...e.slice(1,e.indexOf(`)`)).matchAll(/\[*(?:L[^;]*;|[BCDFIJSZ])/g)].length,Ts=e=>{let t=Cs(e);if(t.readUint32()!==3405691582)throw new u(`A module override is not a class file`);t.readUint16(),t.readUint16();let n=[],r=t.readUint16(),i=new TextDecoder;for(let e=1;e<r;e++){let r=t.readUint8(),a={tag:r,text:``,value:0,first:0,second:0};n[e]=a,r===1?a.text=i.decode(t.readBytes(t.readUint16())):r===3?a.value=t.readInt32():r===4?t.readUint32():r===5||r===6?(t.readBytes(8),e++):r===7||r===8||r===16||r===19||r===20?a.first=t.readUint16():r===15?(t.readUint8(),a.first=t.readUint16()):(a.first=t.readUint16(),a.second=t.readUint16())}t.readUint16(),t.readUint16(),t.readUint16(),t.readBytes(t.readUint16()*2);for(let e=t.readUint16();e>0;e--){t.readBytes(6);for(let e=t.readUint16();e>0;e--)t.readUint16(),t.readBytes(t.readUint32())}let a=[];for(let e=t.readUint16();e>0;e--){let e=t.readUint16(),r=n[t.readUint16()].text,i=n[t.readUint16()].text,o={name:r,arity:ws(i),code:void 0};for(let e=t.readUint16();e>0;e--){let e=n[t.readUint16()].text,r=t.readBytes(t.readUint32());if(e===`Code`){let e=new DataView(r.buffer,r.byteOffset+4,4).getUint32(0);o.code=r.subarray(8,8+e)}}e&1&&e&8&&a.push(o)}return{pool:n,methods:a}},Es=(e,t)=>e[e[t].first].text,Ds=(e,t)=>{let n=e[t],r=e[n.second];return{className:Es(e,n.first),name:e[r.first].text}},Os=(e,t,n,r)=>{let i=()=>new m(`The Java override ${n}.${e.name} computes its value, which tla-ts cannot run`),a=e.code;if(!a)throw i();let o=[],s=()=>{let e=o.pop();if(e===void 0)throw i();return e},c=e=>{let n=t[e];if(n.tag===3)return n.value;if(n.tag===8)return t[n.first].text;throw i()};for(let e=0;e<a.length;){let n=a[e],l=()=>a[e+1]<<8|a[e+2];if(n>=2&&n<=8)o.push(n-3),e+=1;else if(n===16)o.push(a[e+1]<<24>>24),e+=2;else if(n===17)o.push(l()<<16>>16),e+=3;else if(n===18)o.push(c(a[e+1])),e+=2;else if(n===19)o.push(c(l())),e+=3;else if(n===89){let t=s();o.push(t,t),e+=1}else if(n===178){let n=Ds(t,l());if(n.className!==`${Ss}BoolValue`||n.name!==`ValTrue`&&n.name!==`ValFalse`)throw i();o.push({kind:`Identifier`,name:n.name===`ValTrue`?`TRUE`:`FALSE`,location:r}),e+=3}else if(n===184){let n=Ds(t,l()),a=s();if(n.className!==`${Ss}IntValue`||n.name!==`gen`||typeof a!=`number`)throw i();o.push({kind:`Number`,value:a,location:r}),e+=3}else if(n===187)o.push({className:Es(t,l()),value:void 0}),e+=3;else if(n===183){let n=Ds(t,l()),a=s(),o=s();if(!(n.className===`${Ss}StringValue`&&n.name===`<init>`&&typeof a==`string`&&typeof o==`object`&&`className`in o))throw i();o.value={kind:`String`,value:a,location:r},e+=3}else if(n===176){let e=s();if(typeof e!=`object`)throw i();if(`className`in e){if(!e.value)throw i();return e.value}return e}else throw i()}throw i()},ks=(e,t)=>{if(!t)return e;let n=Ts(t),r=e.definitions.map(t=>{if(t.kind!==`Operator`)return t;let r=n.methods.find(e=>e.name===t.name&&e.arity===t.params.length);return r?{...t,body:Os(r,n.pool,e.name,t.location)}:t});return{...e,definitions:r}},Z=(e,t,n)=>({low:e,high:t,isAssociative:n}),As=new Map([[`=>`,Z(1,1,!1)],[`<=>`,Z(2,2,!1)],[`~>`,Z(2,2,!1)],[`-+->`,Z(2,2,!1)],[`/\\`,Z(3,3,!0)],[`\\/`,Z(3,3,!0)],...(/* @__PURE__ */ `=.#.<.>.<=.>=.\\in.\\notin.\\subseteq.\\subset.\\supseteq.\\supset.\\sqsubseteq.\\sqsupseteq.\\sqsubset.\\sqsupset.\\prec.\\preceq.\\succ.\\succeq.\\sim.\\simeq.\\approx.\\cong.\\asymp.\\doteq.\\propto.\\ll.\\gg.|-.-|.|=.=|.:=.::=`.split(`.`)).map(e=>[e,Z(5,5,!1)]),[`\\cdot`,Z(5,14,!0)],[`@@`,Z(6,6,!0)],[`:>`,Z(7,7,!1)],[`<:`,Z(7,7,!1)],[`\\cup`,Z(8,8,!0)],[`\\cap`,Z(8,8,!0)],[`\\`,Z(8,8,!1)],[`..`,Z(9,9,!1)],[`...`,Z(9,9,!1)],[`##`,Z(9,13,!0)],[`$`,Z(9,13,!0)],[`$$`,Z(9,13,!0)],[`??`,Z(9,13,!0)],[`!!`,Z(9,13,!1)],[`\\sqcap`,Z(9,13,!0)],[`\\sqcup`,Z(9,13,!0)],[`\\uplus`,Z(9,13,!0)],[`\\wr`,Z(9,14,!1)],[`+`,Z(10,10,!0)],[`++`,Z(10,10,!0)],[`(+)`,Z(10,10,!0)],[`\\oplus`,Z(10,10,!0)],[`%`,Z(10,11,!1)],[`%%`,Z(10,11,!0)],[`|`,Z(10,11,!0)],[`||`,Z(10,11,!0)],[`\\X`,Z(10,13,!1)],[`-`,Z(11,11,!0)],[`--`,Z(11,11,!0)],[`(-)`,Z(11,11,!0)],[`\\ominus`,Z(11,11,!0)],[`*`,Z(13,13,!0)],[`**`,Z(13,13,!0)],[`/`,Z(13,13,!1)],[`//`,Z(13,13,!1)],[`\\div`,Z(13,13,!1)],[`\\o`,Z(13,13,!0)],[`(.)`,Z(13,13,!0)],[`\\odot`,Z(13,13,!0)],[`(/)`,Z(13,13,!1)],[`\\oslash`,Z(13,13,!1)],[`(\\X)`,Z(13,13,!0)],[`\\otimes`,Z(13,13,!0)],[`&`,Z(13,13,!0)],[`&&`,Z(13,13,!0)],[`\\star`,Z(13,13,!0)],[`\\bullet`,Z(13,13,!0)],[`\\bigcirc`,Z(13,13,!0)],[`^`,Z(14,14,!1)],[`^^`,Z(14,14,!1)]]),js=/* @__PURE__ */ new Set([`^+`,`^*`,`^#`]),Ms=/* @__PURE__ */ new Set([`-`,`~`,`-.`]),Ns=/* @__PURE__ */ new Set([`-`,`~`,`/\\`,`\\/`,`SUBSET`,`UNION`,`DOMAIN`,`ENABLED`,`UNCHANGED`,`[]`,`<>`]),Ps=/* @__PURE__ */ new Set([`SUBSET`,`UNION`,`DOMAIN`,`ENABLED`,`UNCHANGED`,`[]`,`<>`,`'`,...js]),Fs=e=>As.has(e)||js.has(e)||e===`-.`,Is=(e,t,n)=>{switch(e){case`ENABLED`:return{kind:`Enabled`,expression:t,location:n};case`UNCHANGED`:return{kind:`Unchanged`,expression:t,location:n};case`[]`:return{kind:`Always`,expression:t,location:n};case`<>`:return{kind:`Eventually`,expression:t,location:n};case`'`:return{kind:`Prime`,expression:t,location:n};default:return{kind:`Apply`,operator:e,args:[t],location:n}}},Ls=/* @__PURE__ */ new Set([`<<`,`>>`,`:`,`@`,`(`]),Rs=/* @__PURE__ */ new Set([`ASSUME`,`ASSUMPTION`,`AXIOM`,`CONSTANT`,`CONSTANTS`,`COROLLARY`,`INSTANCE`,`LEMMA`,`LOCAL`,`PROPOSITION`,`RECURSIVE`,`THEOREM`,`VARIABLE`,`VARIABLES`]),zs=/* @__PURE__ */ new Set([`THEOREM`,`LEMMA`,`COROLLARY`,`PROPOSITION`]),Bs=/* @__PURE__ */ new Set([`BY`,`PROOF`,`OBVIOUS`,`OMITTED`]),Vs=/* @__PURE__ */ new Set([`Qed`,`Pick`,`Case`,`Assert`]),Hs=/* @__PURE__ */ new Set([``,`*`,`-`]),Us=/* @__PURE__ */ new Set([`CASE`,`CHOOSE`,`DOMAIN`,`ENABLED`,`IF`,`LAMBDA`,`LET`,`SF_`,`SUBSET`,`UNCHANGED`,`UNION`,`WF_`]),Ws=/* @__PURE__ */ new Map([[`CONSTANT`,`Constant`],[`CONSTANTS`,`Constant`],[`VARIABLE`,`Variable`],[`VARIABLES`,`Variable`],[`STATE`,`State`],[`ACTION`,`Action`],[`ACTIONS`,`Action`],[`TEMPORAL`,`Temporal`],[`TEMPORALS`,`Temporal`]]),Gs=/* @__PURE__ */ new Set([`NEW`,...Ws.keys()]),Ks=/* @__PURE__ */ new Set([`(`,`[`,`{`,`<<`]),qs=/* @__PURE__ */ new Set([`)`,`]`,`}`,`>>`,`]_`,`>>_`]),Js=/* @__PURE__ */ new Set([`TRUE`,`FALSE`,`BOOLEAN`,`STRING`]),Ys=e=>RegExp(`^-{4,}\\s*MODULE\\s+${e}\\s*-{3,}$`),Xs=(e,t)=>{let n=e.split(/\r?\n/),r=n.findIndex(e=>Ys(t).test(e));if(r===-1)return;let i=n.findIndex((e,t)=>t>r&&e.startsWith(`====`));return n.slice(r,i===-1?void 0:i+1).join(`
+`)},Zs=e=>{let t=ie(e),n={index:0,offsideColumns:[]},r=[],i=/* @__PURE__ */ new Set,a=[],o={index:-1},s=[],c=e=>r[r.length-1].has(e),l=e=>({line:e.line,column:e.column,range:void 0}),d=[],f=[],p=[],m=e=>{let r=n.index-1,i=e===r?p[e]:void 0;if(i)return i;let a=t[r];d[e]??=l(t[e]),f[r]??={line:a.line,column:a.endColumn};let o={module:s[s.length-1].name,start:d[e],end:f[r]};return e===r&&(p[e]=o),o},h=(e,t)=>(e.location.range=m(t),e),g=(e=0)=>t[Math.min(n.index+e,t.length-1)],_=(e=0)=>{let t=g(e),r=n.offsideColumns[n.offsideColumns.length-1];return r===void 0||r===-1||t.kind===`End`?t:t.column<=r?{...t,kind:`End`,text:``}:t},v=e=>e.kind===`End`?`end of input`:JSON.stringify(e.text),y=(e,t=g())=>new u(`${e} at line ${t.line}, column ${t.column}`),b=e=>e.kind===`Identifier`||e.kind===`Keyword`,x=(e,t=0)=>{let n=_(t);return n.text===e&&n.kind!==`String`&&n.kind!==`End`},S=()=>{let e=_();if(e.kind===`End`)throw y(`Unexpected end of expression`);return n.index++,e},C=e=>x(e)?(n.index++,!0):!1,w=e=>{if(!x(e))throw y(`Expected ${JSON.stringify(e)} but found ${v(_())}`);return S()},T=()=>{let e=_();if(e.kind!==`Identifier`)throw y(`Expected an identifier but found ${v(e)}`);return n.index++,e.text},te=e=>{n.offsideColumns.push(-1);let t=e();return n.offsideColumns.pop(),t},E=(e,t=`,`)=>{let n=[e()];for(;C(t);)n.push(e());return n},ne=()=>{if(x(`<<`)){let e={value:1};for(;_(e.value).kind===`Identifier`||x(`,`,e.value);)e.value++;return x(`>>`,e.value)&&x(`\\in`,e.value+1)}let e={value:0};for(;_(e.value).kind===`Identifier`;){if(x(`\\in`,e.value+1))return!0;if(!x(`,`,e.value+1))return!1;e.value+=2}return!1},re=()=>{if(x(`::`))return!0;if(!x(`(`))return!1;let e={value:1};for(;_(e.value).kind===`Identifier`&&x(`,`,e.value+1);)e.value+=2;return _(e.value).kind===`Identifier`&&x(`)`,e.value+1)&&x(`::`,e.value+2)},D=()=>{if(!C(`<<`))return{kind:`Name`,name:T()};let e=E(T);return w(`>>`),{kind:`Tuple`,names:e}},ae=()=>E(()=>{let e=E(D);w(`\\in`);let t=j();return e.map(e=>({pattern:e,set:t}))}).flat(),oe=()=>{let e=_();if(e.kind===`Identifier`){let t=n.index,r=[T()];for(;x(`!`)&&_(1).kind===`Identifier`;)S(),r.push(T());return h({kind:`Identifier`,name:r.join(`!`),location:l(e)},t)}if(x(`<<`)||x(`(`))return ge();throw y(`Expected a subscript but found ${v(e)}`)},se=e=>{let t=_(1),n=_(2);return t.kind===`Identifier`&&n.text===`==`?!0:t.line===e.line?!1:t.text===`-.`||t.kind===`Identifier`&&(n.text===`(`||n.text===`[`||n.kind===`Operator`&&x(`==`,js.has(n.text)?3:4))},ce=e=>{if(!Ns.has(e.text))return!0;let t=_(1);return t.kind===`End`||t.kind===`ModuleEnd`||t.kind===`Separator`||x(`,`,1)||x(`)`,1)||t.kind===`Keyword`&&Rs.has(t.text)||se(e)},le=()=>{let e=_();if(e.kind===`Operator`&&(As.has(e.text)||Ms.has(e.text))&&ce(e))return n.index++,h({kind:`OperatorReference`,operator:e.text,location:l(e)},n.index-1);if(e.kind!==`String`&&Ps.has(e.text)&&ce(e)){n.index++;let t=l(e);if(js.has(e.text))return{kind:`OperatorReference`,operator:e.text,location:t};let r={kind:`Identifier`,name:`argument`,location:t};return{kind:`Lambda`,params:[r.name],body:Is(e.text,r,t),location:t}}if(x(`LAMBDA`)){let t=n.index;S();let r=E(T);w(`:`);let i=j();return h({kind:`Lambda`,params:r,body:i,location:l(e)},t)}return j()},ue=()=>te(()=>{w(`(`);let e=E(le);return w(`)`),e}),de=()=>{let e=S();n.offsideColumns.push(e.column);let t=[j()];for(;g().text===e.text&&g().column===e.column;)n.index++,t.push(j());return n.offsideColumns.pop(),{kind:e.text===`/\\`?`And`:`Or`,operands:t,location:l(e)}},fe=e=>te(()=>{let t=l(e);if(_().kind===`Identifier`&&(x(`|->`,1)||x(`:`,1))){let e=x(`|->`,1)?`Record`:`RecordSet`,n=E(()=>{let t=T();return w(e===`Record`?`|->`:`:`),{name:t,value:j()}});return w(`]`),{kind:e,fields:n,location:t}}if(ne()){let e=ae();w(`|->`);let n=j();return w(`]`),{kind:`FunctionConstruction`,bounds:e,body:n,location:t}}let n=j();if(C(`->`)){let e=j();return w(`]`),{kind:`FunctionSet`,domain:n,range:e,location:t}}if(C(`EXCEPT`)){let e=E(()=>{w(`!`);let e=[];for(;x(`.`)||x(`[`);)if(C(`.`)){if(!b(_()))throw y(`Expected a field name but found ${v(_())}`);e.push({kind:`Field`,name:S().text})}else w(`[`),e.push({kind:`Index`,args:E(()=>j())}),w(`]`);return w(`=`),{path:e,value:j()}});return w(`]`),{kind:`Except`,function:n,updates:e,location:t}}return w(`]_`),{kind:`BoxAction`,action:n,subscript:oe(),location:t}}),pe=e=>te(()=>{let t=l(e);if(C(`}`))return{kind:`SetEnumeration`,elements:[],location:t};if(ne()&&(_(1).text===`\\in`||x(`<<`))){let e=n.index,r=D();w(`\\in`);let i=j();if(C(`:`)){let e=j();return w(`}`),{kind:`SetFilter`,bound:{pattern:r,set:i},predicate:e,location:t}}n.index=e}let r=j();if(C(`:`)){let e=ae();return w(`}`),{kind:`SetMap`,expression:r,bounds:e,location:t}}let i=[r];for(;C(`,`);)i.push(j());return w(`}`),{kind:`SetEnumeration`,elements:i,location:t}}),O=e=>{let t=l(e),n=te(()=>x(`>>`)||x(`>>_`)?[]:E(()=>j()));if(C(`>>_`)){if(n.length!==1)throw y(`Expected a single action inside <<A>>_v`,e);return{kind:`AngleAction`,action:n[0],subscript:oe(),location:t}}return w(`>>`),{kind:`Tuple`,elements:n,location:t}},k=e=>{let t=l(e),n=e.text===`\\A`?`Forall`:`Exists`,r=e.text===`\\AA`||e.text===`\\EE`;if(!r&&ne()){let e=ae();return w(`:`),{kind:n,bounds:e,body:j(),location:t}}let i=E(T);return w(`:`),{kind:`UnboundedQuantifier`,names:i,body:j(),isTemporal:r,location:t}},A=e=>{let t=[];do{if(C(`OTHER`))return w(`->`),{kind:`Case`,arms:t,other:j(),location:l(e)};let n=j();w(`->`),t.push({condition:n,body:j()})}while(C(`[]`));return{kind:`Case`,arms:t,other:void 0,location:l(e)}},me=()=>{let e=_(1);return x(`!`)&&(e.kind===`Identifier`||e.kind===`Number`||Ls.has(e.text)||e.kind===`Operator`&&(As.has(e.text)||js.has(e.text)||Ms.has(e.text)))},he=()=>{let e=S();if(e.kind===`Number`)return{kind:`Operand`,operand:ee(e.text)};switch(e.text){case`<<`:case`>>`:return{kind:`Operand`,operand:e.text};case`:`:return{kind:`Colon`};case`@`:return{kind:`At`};case`(`:return n.index--,{kind:`Bound`,args:ue()}}return{kind:`Name`,name:e.text,args:x(`(`)?ue():[]}},ge=()=>{let e=n.index===o.index,t=S(),i=l(t);if(t.kind===`Number`)return{kind:`Number`,value:ee(t.text),text:t.text,location:i};if(t.kind===`Decimal`)return{kind:`Decimal`,text:t.text,location:i};if(t.kind===`String`)return{kind:`String`,value:t.text,location:i};let a=t.kind===`Step`&&N(t);if(a&&Oe()<0&&M.length<=1)throw y(`Step number used outside proof`,t);if(a&&t.text[1]===`+`)throw y(`<+> step number used in an expression`,t);if(t.kind===`Identifier`||a){let n=a?je(t)??t.text:t.text;if(re()){let e=C(`(`)?E(T):[];return e.length>0&&w(`)`),w(`::`),{kind:`Label`,name:n,params:e,body:j(),location:i}}let r=x(`(`),o=r?ue():[];if(!me())return r?{kind:`Apply`,operator:n,args:o,location:i}:{kind:`Identifier`,name:n,location:i};let c=s.flatMap(e=>e.instances).find(e=>e.name===n);if(c&&!e&&c.params.length!==o.length)throw y(`The operator ${n} requires ${c.params.length} arguments`,t);let l=[{kind:`Name`,name:n,args:o}];for(;me();)S(),l.push(he());let u=l.flatMap(e=>e.kind===`Name`?[e.name]:[]);if(u.length<l.length)return{kind:`Subexpression`,selectors:l,location:i};let d=u.join(`!`),f=l.flatMap(e=>`args`in e?e.args:[]);return f.length>0?{kind:`Apply`,operator:d,args:f,location:i}:{kind:`Identifier`,name:d,location:i}}if(t.kind===`Operator`&&Fs(t.text)&&x(`(`))return{kind:`Apply`,operator:t.text,args:ue(),location:i};switch(t.text){case`(`:{let e=te(()=>j());return w(`)`),e}case`[`:return fe(t);case`{`:return pe(t);case`<<`:return O(t);case`@`:return{kind:`ExceptAt`,location:i};case`\\A`:case`\\E`:case`\\AA`:case`\\EE`:return k(t);case`IF`:{let e=j();w(`THEN`);let t=j();return w(`ELSE`),{kind:`If`,condition:e,consequent:t,alternative:j(),location:i}}case`CASE`:return A(t);case`LET`:{let e=[],t=[];for(r.push(/* @__PURE__ */ new Set);!C(`IN`);){if(C(`RECURSIVE`)){Te();continue}let n=be(!1);n.kind===`Instance`?t.push(n):e.push(n)}r.pop();let n=j();return t.length===0?{kind:`Let`,definitions:e,body:n,location:i}:{kind:`Let`,definitions:e,instances:t,body:n,location:i}}case`CHOOSE`:{let e=D(),t=C(`\\in`)?j():void 0;return w(`:`),{kind:`Choose`,pattern:e,set:t,body:j(),location:i}}case`WF_`:case`SF_`:{let e=oe(),n=te(()=>{w(`(`);let e=j();return w(`)`),e});return{kind:t.text===`WF_`?`WeakFairness`:`StrongFairness`,subscript:e,action:n,location:i}}}throw y(`Unexpected ${v(t)}`,t)},_e=()=>{let e=_(),t=l(e);if(e.kind===`Operator`&&(e.text===`/\\`||e.text===`\\/`))return de();if(e.kind===`Operator`||e.kind===`Keyword`)switch(e.text){case`~`:return S(),{kind:`Apply`,operator:`~`,args:[j(5)],location:t};case`-`:return S(),{kind:`Apply`,operator:`-.`,args:[j(13)],location:t};case`[]`:return S(),{kind:`Always`,expression:j(16),location:t};case`<>`:return S(),{kind:`Eventually`,expression:j(16),location:t};case`ENABLED`:return S(),{kind:`Enabled`,expression:j(16),location:t};case`UNCHANGED`:return S(),{kind:`Unchanged`,expression:j(16),location:t};case`SUBSET`:case`UNION`:case`DOMAIN`:return S(),{kind:`Apply`,operator:e.text,args:[j(9)],location:t}}return ge()},j=(e=0)=>{let t=n.index,r=_e(),i={left:r.location.range?r:h(r,t),previous:void 0};for(;;){let n=_();if(n.kind!==`Operator`)break;let r=l(n);if(n.text===`'`&&e<=15){S(),i.left=h({kind:`Prime`,expression:i.left,location:r},t);continue}if(js.has(n.text)&&e<=15){S(),i.left=h({kind:`Apply`,operator:n.text,args:[i.left],location:r},t);continue}if(n.text===`[`){S();let e=te(()=>E(()=>j()));te(()=>w(`]`)),i.left=h({kind:`FunctionApplication`,function:i.left,args:e,location:r},t);continue}if(n.text===`.`&&b(_(1))){S();let e=S().text;i.left=h({kind:`FieldAccess`,record:i.left,field:e,location:r},t);continue}let a=As.get(n.text);if(!a||a.low<e)break;let o=i.previous;if(o){let e=!(o.low>a.high||o.high<a.low),t=o.text===n.text&&a.isAssociative;if(e&&!t&&(o.text!==`\\X`||n.text!==`\\X`))throw y(`Precedence conflict between ${o.text} and ${n.text}`,n)}S();let s=j(a.high+1),c=i.left;if(n.text===`/\\`||n.text===`\\/`){let e=n.text===`/\\`?`And`:`Or`;i.left=c.kind===e&&o?.text===n.text?{...c,operands:[...c.operands,s]}:{kind:e,operands:[c,s],location:r}}else i.left=n.text===`\\X`?c.kind===`Product`&&o?.text===`\\X`?{...c,factors:[...c.factors,s]}:{kind:`Product`,factors:[c,s],location:r}:{kind:`Apply`,operator:n.text,args:[c,s],location:r};i.left=h(i.left,t),i.previous={...a,text:n.text}}return i.left},ve=()=>{if(!C(`(`))return[];let e=we();return w(`)`),e},ye=()=>{let e=l(_()),r=j(),i=t[n.index-1],a={line:i.line,column:i.endColumn};return{body:r,bodyRange:{module:s[s.length-1].name,start:e,end:a}}},be=e=>{let t=n.index;return h(xe(e),t)},xe=e=>{let t=_(),r=l(t),i=(t,n)=>({kind:`Operator`,name:t,params:n,...ye(),isLocal:e,isRecursive:c(t),location:r});if(t.kind===`Identifier`&&_(1).kind===`Operator`&&As.has(_(1).text)&&_(2).kind===`Identifier`&&x(`==`,3)){let e=T(),t=S().text,n=T();return w(`==`),i(t,[{name:e,arity:0},{name:n,arity:0}])}let a=t.kind===`Operator`&&t.text===`-.`,o=t.kind===`Identifier`&&js.has(_(1).text)&&x(`==`,2);if(a||o){let e=a?t.text:_(1).text;n.index+=a?1:2;let r=a?T():t.text;return w(`==`),i(e,[{name:r,arity:0}])}let s=T();if(C(`[`)){let t=te(()=>ae());return w(`]`),w(`==`),{kind:`Function`,name:s,bounds:t,body:j(),isLocal:e,isRecursive:c(s),location:r}}let u=ve();return w(`==`),x(`INSTANCE`)?Se(s,u,e,r):i(s,u)},Se=(e,t,n,r)=>(w(`INSTANCE`),{kind:`Instance`,name:e,params:t,module:T(),substitutions:C(`WITH`)?E(()=>{let e=S().text;return w(`<-`),{name:e,expression:le()}}):[],isLocal:n,location:r}),Ce=()=>{let e=l(_());if(x(`_`)&&_(1).kind===`Operator`)return S(),{name:S().text,arity:C(`_`)?2:1,location:e};if(_().kind===`Operator`&&x(`_`,1)){let t=S().text;return S(),{name:t===`-`?`-.`:t,arity:1,location:e}}let t=T();if(!C(`(`))return{name:t,arity:0,location:e};let n=E(()=>w(`_`));return w(`)`),{name:t,arity:n.length,location:e}},we=()=>E(Ce),Te=()=>we().forEach(e=>r[r.length-1].add(e.name)),Ee=e=>{let t={value:0,offset:e};do{let e=_(t.offset);if(e.kind===`End`)return t.offset;e.kind===`Operator`&&Ks.has(e.text)&&t.value++,e.kind===`Operator`&&qs.has(e.text)&&t.value--,t.offset++}while(t.value>0);return t.offset},De=()=>{let e=_(),t=_(1);return e.kind===`Identifier`?x(`(`,1)||x(`[`,1)?x(`==`,Ee(1)):t.kind===`Operator`&&js.has(t.text)?x(`==`,2):t.kind===`Operator`&&As.has(t.text)?_(2).kind===`Identifier`&&x(`==`,3):x(`==`,1):x(`-.`)&&t.kind===`Identifier`&&x(`==`,2)},M=[],Oe=()=>M[M.length-1]??-1,ke=e=>e.text[1]===`*`?-1:e.text[1]===`+`?-2:Number(e.text.slice(1,e.text.indexOf(`>`))),Ae=e=>{let t=e.text.slice(e.text.indexOf(`>`)+1),n={value:t.length};for(;t[n.value-1]===`.`;)n.value--;return t.slice(0,n.value)},N=e=>!e.text.endsWith(`.`)&&!Hs.has(Ae(e)),je=e=>{let t=Ae(e);if(Hs.has(t))return;let n=ke(e);if(n>=0)return`<${n}>${t}`;let r=Oe(),i=M[M.length-2];return`<${r<0&&i!==void 0?i:r}>${t}`},Me=e=>{if(e.kind===`Keyword`)return Bs.has(e.text);if(e.kind!==`Step`)return!1;if(e.text[1]===`*`)return M.length===0;if(e.text[1]===`+`||M.length===0)return!0;let t=Oe();return t>=0&&ke(e)>t},Ne=e=>{let t=ke(e),n=M.length-1,r=M[n-1]??-1,i=M[n]<0;return i&&(M[n]=t<0?r+1:t),t===-1?!0:t===-2?i:i?t>r:M[n]===t},Pe=e=>!i.has(e)&&s.some(t=>t.constants.some(t=>t.name===e)||t.variables.some(t=>t.name===e)||t.definitions.some(t=>t.name===e)),P=e=>e.kind===`ModuleFact`||e.kind===`Subexpression`?!0:e.kind===`Apply`?e.operator.includes(`!`):e.kind===`Identifier`?e.name.startsWith(`<`)||e.name.includes(`!`)?!0:!Js.has(e.name)&&!Pe(e.name):!1,Fe=()=>{let e=_();return e.kind===`Step`?N(e):e.kind===`Keyword`?Us.has(e.text):e.kind===`End`||e.kind===`ModuleEnd`||e.kind===`Separator`?!1:!De()},Ie=()=>{let e=n.index;o.index=e;let t=_();return t.kind===`Operator`&&!Ns.has(t.text)&&Fs(t.text)?(n.index++,h({kind:`OperatorReference`,operator:t.text,location:l(t)},e)):C(`MODULE`)?h({kind:`ModuleFact`,name:T(),location:l(t)},e):j()},Le=e=>a[a.length-1]?.add(e),F=e=>{a.push(/* @__PURE__ */ new Set);let t=e();return a.pop(),t},Re=e=>a.some(t=>t.has(e))||s.some(t=>t.constants.some(t=>t.name===e)||t.variables.some(t=>t.name===e)),ze=()=>{let e=E(Ie),t=e.find(e=>e.kind===`Identifier`&&Re(e.name));if(t)throw y(`DEF clause entry should describe a defined operator`,t.location);return e},Be=()=>({facts:Fe()?E(Ie):[],defs:C(`DEF`)||C(`DEFS`)?ze():[]}),Ve=()=>{let e=n.index,t=S(),r=t.text===`USE`&&C(`ONLY`),i={kind:t.text===`USE`?`Use`:`Hide`,isOnly:r,...Be(),location:l(t)},a=i.kind===`Hide`?i.facts.find(e=>!P(e)):void 0;if(a)throw y(`The only expression allowed as a fact in a HIDE is the name of a theorem, assumption, or step`,a.location);return h(i,e)},He=()=>{let e=n.index,t=l(_()),r=C(`NEW`),i=_().kind===`Keyword`?Ws.get(_().text):void 0;if(!r&&i===void 0)throw y(`Expected a declaration but found ${v(_())}`);if(i!==void 0&&S(),i===`Variable`){let n=T();return Le(n),h({kind:`NewSymbol`,name:n,arity:0,level:i,set:void 0,location:t},e)}let a=Ce();Le(a.name);let o=(i??`Constant`)===`Constant`&&x(`\\in`);if(o&&a.arity>0)throw y(`declared symbol with arguments before \\in`);return o&&S(),h({kind:`NewSymbol`,name:a.name,arity:a.arity,level:i??`Constant`,set:o?j():void 0,location:t},e)},Ue=()=>{let e=n.index,t=l(w(`ASSUME`)),r=E(()=>x(`ASSUME`)?F(Ue):_().kind===`Keyword`&&Gs.has(_().text)?He():j());return w(`PROVE`),h({kind:`AssumeProve`,assumptions:r,conclusion:j(),location:t},e)},We=e=>{let t={value:0};for(;_(t.value).kind===`Identifier`&&x(`,`,t.value+1);)t.value+=2;return _(t.value).kind===`Identifier`&&x(e,t.value+1)},Ge=(e,t)=>{e.forEach(Le),t.forEach(e=>(e.pattern.kind===`Name`?[e.pattern.name]:e.pattern.names).forEach(Le))},Ke=()=>{let e=_();if(x(`USE`)||x(`HIDE`))return Ve();if(x(`INSTANCE`))return h(Se(void 0,[],!1,l(e)),n.index);if(x(`DEFINE`)||De()){let t=n.index;C(`DEFINE`);let r=[be(!1)];for(;De();)r.push(be(!1));let i={kind:`Define`,definitions:r,location:l(e)};return h(i,t)}if(C(`HAVE`))return{kind:`Have`,expression:j()};if(C(`TAKE`)){let e=ne(),t=e?[]:E(T),n=e?ae():[];return Ge(t,n),{kind:`Take`,names:t,bounds:n}}if(C(`WITNESS`))return{kind:`Witness`,expressions:E(()=>j())};if(C(`PICK`)){let e=We(`:`),t=e?E(T):[],n=e?[]:ae();return Ge(t,n),w(`:`),{kind:`Pick`,names:t,bounds:n,body:j()}}return C(`CASE`)?{kind:`Case`,expression:j()}:{kind:`Assert`,isSuffices:C(`SUFFICES`),statement:x(`ASSUME`)?Ue():j()}},qe=e=>{let t=_();if(t.kind!==`Step`)throw y(`Expected a step number but found ${v(t)}`);if(!Ne(t))throw y(`${e?`QED step`:`step`}'s number has bad level`,t);if(ke(t)<0&&je(t)!==void 0)throw y(`<*> and <+> cannot be used for a named step`,t);return n.index++,{name:je(t),location:l(t)}},Je=()=>{let e=n.index,t=qe(x(`QED`,1)),r=/* @__PURE__ */ new Set;a.push(r);let i=C(`QED`)?{kind:`Qed`}:Ke(),o=Me(_());if(o&&!Vs.has(i.kind))throw y(`Proof of a step that does not take a proof`);let s=o?Xe():void 0;return a.pop(),(i.kind!==`Assert`||i.isSuffices)&&r.forEach(Le),h({...t,body:i,proof:s},e)},Ye=()=>{let e=l(_());if(x(`BY`)||x(`PROOF`)&&x(`BY`,1))return C(`PROOF`),S(),{kind:`By`,isOnly:C(`ONLY`),...Be(),location:e};let t=_(+!!x(`PROOF`));if(t.kind===`Keyword`&&(t.text===`OBVIOUS`||t.text===`OMITTED`))return C(`PROOF`),S(),{kind:t.text===`OBVIOUS`?`Obvious`:`Omitted`,location:e};C(`PROOF`);let n=[Je()];for(;n[n.length-1].body.kind!==`Qed`;)n.push(Je());return{kind:`Steps`,level:Oe(),steps:n,location:e}},Xe=()=>{let e=n.index;M.push(-1);let t=F(Ye);return M.pop(),h(t,e)},Ze=e=>{let t=n.index,r=S(),a=_().kind===`Identifier`&&x(`==`,1)?T():void 0;a!==void 0&&(i.add(a),S());let o=F(()=>({statement:x(`ASSUME`)?Ue():j(),proof:Me(_())?Xe():void 0})),s=o.statement;e.theorems.push(h({name:a,statement:s,proof:o.proof,location:l(r)},t)),a!==void 0&&s.kind!==`AssumeProve`&&e.definitions.push(h({kind:`Operator`,name:a,params:[],body:s,isLocal:!1,isRecursive:!1,location:l(r)},t))},Qe=()=>{let e=n.index;return h($e(),e)},$e=()=>{let e=S(),t=l(e),n=e.text===`AXIOM`;if(_().kind===`Identifier`&&x(`==`,1)){let e=T();return i.add(e),S(),{name:e,expression:j(),isAxiom:n,location:t}}return{name:void 0,expression:j(),isAxiom:n,location:t}},et=()=>{let e=l(w(`----`));w(`MODULE`);let t=T();w(`----`);let i={name:t,modules:[],extends:C(`EXTENDS`)?E(T):[],constants:[],variables:[],definitions:[],instances:[],assumptions:[],location:e,theorems:[],uses:[]};for(s.push(i),r.push(/* @__PURE__ */ new Set);;){let e=n.index,t=_();if(t.kind===`ModuleEnd`||t.kind===`End`)return s.pop(),r.pop(),i;if(t.kind===`Separator`){if(x(`MODULE`,1)){i.modules.push(et()),w(`====`);continue}S();continue}switch(t.text){case`CONSTANT`:case`CONSTANTS`:S(),i.constants.push(...we());continue;case`VARIABLE`:case`VARIABLES`:S(),i.variables.push(...E(()=>{let e=n.index,t=l(_());return h({name:T(),arity:0,location:t},e)}));continue;case`ASSUME`:case`ASSUMPTION`:case`AXIOM`:{let e=Qe();i.assumptions.push(e),e.name!==void 0&&i.definitions.push({kind:`Operator`,name:e.name,params:[],body:e.expression,isLocal:!1,isRecursive:!1,location:e.location});continue}case`USE`:case`HIDE`:i.uses.push(Ve());continue;case`RECURSIVE`:S(),Te();continue;case`INSTANCE`:i.instances.push(h(Se(void 0,[],!1,l(t)),e));continue;case`LOCAL`:{if(S(),x(`INSTANCE`)){i.instances.push(h(Se(void 0,[],!0,l(t)),e));continue}let n=be(!0);n.kind===`Instance`?i.instances.push(n):i.definitions.push(n);continue}}if(t.kind===`Keyword`&&zs.has(t.text)){Ze(i);continue}let a=be(!1);a.kind===`Instance`?i.instances.push(a):i.definitions.push(a)}};return et()},Qs=25214903917n,$s=(1n<<48n)-1n,ec=2147483647,tc=e=>{let t={value:(BigInt.asUintN(64,e)^Qs)&$s},n=e=>(t.value=t.value*Qs+11n&$s,Number(BigInt.asIntN(32,t.value>>BigInt(48-e))));return{setSeed:e=>{t.value=(BigInt.asUintN(64,e)^Qs)&$s},nextInt:e=>{let t=n(31),r=e-1;if((e&r)===0)return Number(BigInt(e)*BigInt(t)>>31n);for(let i=t;;i=n(31)){let t=i%e;if(i-t+r<=ec)return t}},nextLong:()=>BigInt.asIntN(64,(BigInt(n(32))<<32n)+BigInt(n(32))),nextDouble:()=>(n(26)*2**27+n(27))*2**-53}},nc=10454148508367108822n,rc=(()=>{let e=[];for(let t=1n<<63n;e.length<72;)e.push(t),t=t>>1n^((t&1n)==0n?0n:nc);return Array.from({length:256},(t,n)=>e.slice(64,72).reverse().reduce((e,t,r)=>n>>r&1?e^t:e,0n))})(),ic=Int32Array.from(rc,e=>Number(BigInt.asIntN(32,e>>32n))),ac=Int32Array.from(rc,e=>Number(BigInt.asIntN(32,e))),oc=Number(BigInt.asIntN(32,nc>>32n)),sc=Number(BigInt.asIntN(32,nc));let cc=oc,lc=sc;const uc=e=>{let t=(e^lc)&255;lc=(lc>>>8|cc<<24)^ac[t],cc=cc>>>8^ic[t]},dc=e=>{for(let t=0;t<32;t+=8)uc(e>>>t)},fc=e=>{if(typeof e==`boolean`)uc(0),uc(e?116:102);else if(typeof e==`number`)uc(1),dc(e);else if(typeof e==`string`){uc(3),dc(e.length);for(let t=0;t<e.length;t++)uc(e.charCodeAt(t))}else if(A(e))uc(21),dc(ke(e.name)+1);else if(k(e)){let t=V(e);uc(9),dc(t.domain.length);for(let e=0;e<t.domain.length;e++)fc(t.domain[e]),fc(t.range[e])}else{let t=R(e).elements;uc(5),dc(t.length);for(let e of t)fc(e)}},pc=e=>{let t={high:cc,low:lc};cc=oc,lc=sc;for(let t of e)fc(t);let n=BigInt(cc>>>0)<<32n|BigInt(lc>>>0);return cc=t.high,lc=t.low,n},mc=e=>{if(typeof e==`boolean`)return 2;if(typeof e==`number`||A(e))return 5;if(typeof e==`string`)return 5+e.length;if(k(e)){let t=V(e);return t.domain.reduce((e,n,r)=>e+mc(n)+mc(t.range[r]),5)}return R(e).elements.reduce((e,t)=>e+mc(t),5)},hc=e=>{let t=/* @__PURE__ */ new Int32Array(4096);for(let n=0;n<64;n++){cc=n<32?0:1<<n-32,lc=n<32?1<<n:0;for(let t=0;t<e;t++)uc(0);let r=n>>3,i=1<<(n&7);for(let e=i;e<2*i;e++){let n=(r*256+e)*2,a=(r*256+e-i)*2;t[n]=t[a]^cc,t[n+1]=t[a+1]^lc}}return t},gc=()=>{let e=/* @__PURE__ */ new Map,t=/* @__PURE__ */ new Map,n=[],r=e=>{let r=t.get(e);if(r!==void 0)return r;let i=mc(e);return cc=0,lc=0,fc(e),t.set(e,n.length),n.push(i,cc,lc),n.length-3},i=t=>{let n=e.get(t);if(n)return n;let r=hc(t);return e.set(t,r),r};return e=>{let t={high:cc,low:lc},a={high:oc,low:sc};for(let t of e){let e=r(t),o=i(n[e]),s={high:n[e+1],low:n[e+2]};for(let e=0;e<8;e++){let t=e<4?a.low:a.high,n=(e*256+(t>>>(e&3)*8&255))*2;s.high^=o[n],s.low^=o[n+1]}a.high=s.high,a.low=s.low}return cc=t.high,lc=t.low,BigInt(a.high>>>0)<<32n|BigInt(a.low>>>0)}},_c=[],vc=e=>{for(let t=2;t*t<=e;t++)if(e%t===0)return!1;return!0},yc=()=>{for(let e=1277011;_c.length<1341;e++)vc(e)&&_c.push(e);return _c},bc=e=>{let t=yc(),n={index:t.length};for(;n.index===t.length;)n.index=Math.floor(e.nextDouble()*t.length);return t[n.index]},xc=e=>{let t=[],n={value:e};for(let e=2;e*e<=n.value;e++)for(;n.value%e===0;)t.push(e),n.value/=e;return n.value>1&&t.push(n.value),t},Sc=e=>{for(let t=Math.max(e,9);;t++){let e=xc(t),n=new Set(e);if(t%4!=0&&n.size!==e.length)return{modulus:BigInt(t),multiplier:BigInt([...n].reduce((e,t)=>e*t,1)+1)}}},Cc=(e,t,n)=>{if(t<=0)return[];let r=Sc(t),i={index:BigInt(n.nextInt(t))},a=BigInt(bc(n));return Array.from({length:e},()=>{do i.index=(r.multiplier*i.index+a)%r.modulus;while(i.index>=t);return i.index})},wc=(1n<<63n)-1n-24n,Tc=(e,t,n)=>{let r=n.nextLong(),i=BigInt.asIntN(64,r<0n?-r:r);return Array.from({length:e},(e,n)=>{let r=(wc*BigInt(n)+i)%t;return r<0n?r+t:r})},Ec=(e,t)=>e.reduceRight((e,t)=>({remaining:e.remaining/BigInt(t.length),elements:[t[Number(e.remaining%BigInt(t.length))],...e.elements]}),{remaining:t,elements:[]}).elements,Dc=e=>{if(typeof e==`object`){if(e.kind===`FunctionSet`){let t=Dt(e.domain),n=R(e.range).elements;return{lists:t.map(()=>n),create:e=>F(t,e)}}if(e.kind===`RecordSet`)return{lists:e.sets.map(e=>R(e).elements),create:t=>kt(e.names.map((e,n)=>[e,t[n]]))};if(e.kind===`ProductSet`)return{lists:e.factors.map(e=>R(e).elements),create:I}}},Oc=(e,t,n)=>{if(z(t))return[];if(typeof t==`object`&&t.kind===`Interval`)return Cc(e,Math.max(0,t.high-t.low+1),n).map(e=>t.low+Number(e));let r=Dc(t);if(r){let t=r.lists.reduce((e,t)=>e*BigInt(t.length),1n);return(t>BigInt(ec)?Tc(e,t,n):Cc(e,Number(t),n)).map(e=>r.create(Ec(r.lists,e)))}let i=R(t).elements;return Cc(e,i.length,n).map(e=>i[Number(e)])},kc=(e,t)=>{let n=e[Math.floor(t.nextDouble()*e.length)];if(n===void 0)throw new f(`RandomElement of the empty set`);return n},Ac=(e,t)=>{if(typeof e==`object`&&e.kind===`FunctionSet`){let n=[...Dt(e.domain)];return F(n,n.map(()=>Ac(e.range,t)))}if(typeof e==`object`&&e.kind===`RecordSet`)return kt(e.names.map((n,r)=>[n,Ac(e.sets[r],t)]));if(typeof e==`object`&&e.kind===`ProductSet`)return I(e.factors.map(e=>Ac(e,t)));if(typeof e==`object`&&e.kind===`Interval`){let n=Math.max(0,e.high-e.low+1),r=Math.floor(t.nextDouble()*n);if(r>=n)throw new f(`RandomElement of the empty set`);return e.low+r}return kc(R(e).elements,t)},jc=(e,t=0n)=>{let n=tc(t),r={random:tc(t),state:void 0},i={isStartup:!1},a={getLevel:()=>0,getBehavior:()=>[],getSpecification:()=>kt([]),counterExample:void 0,isSeen:()=>!1,setLivenessSource:()=>{},getCurrentState:()=>void 0,getFingerprint:pc,getRandom:()=>{let e=i.isStartup?void 0:a.getCurrentState();return e===void 0?n:(e!==r.state&&(r.random.setSeed(a.getFingerprint(e)^BigInt.asUintN(64,t)),r.state=e),r.random)},evaluateAtStartup:e=>{let t=i.isStartup;i.isStartup=!0;try{return e()}finally{i.isStartup=t}},pause:()=>{},seed:t,generatedStates:0,distinctStates:0,initialStates:0,queueSize:0,diameter:1,registers:/* @__PURE__ */ new Map,namedRegisters:/* @__PURE__ */ new Map,properties:/* @__PURE__ */ new Map,possibleCounts:/* @__PURE__ */ new Map,isStopped:!1,checkDeadlock:e,startedAt:Date.now()};return a},Mc=e=>yt([...e.possibleCounts].map(([e,t])=>[e,t])),Nc=e=>e.possibleCounts.size===0?e.namedRegisters:new Map([...e.namedRegisters,[`s:_possible`,Mc(e)]]),Pc=(e,t,n)=>new p(`Applying ${e} to the following value,\nwhich is not ${t}:\n${H(n)}`),Fc=(e,t,n,r)=>new p(`The ${e} argument of ${t} should be a ${n}, but instead it is:\n${H(r)}`),Ic=e=>k(e)?V(e):void 0,Lc=(e,t,n)=>{let r=U(e,t,n),i=Ic(r);if(!i)throw Pc(n,`a function with a finite domain`,r);return i},Rc=(e,t,n)=>{let r=U(e,t,n),i=Ic(r);if(!i)throw Fc(t===0?`first`:`second`,n,`bag`,r);return i},zc=(e,t)=>{if(!O(e)||!L(e))throw t();return R(e).elements},Bc=e=>e.range.every(e=>typeof e==`number`&&e>0),Vc=(e,t)=>{let n=e.domain.findIndex(e=>Re(e,t));return n===-1?void 0:e.range[n]},Hc=(e,t,n)=>`public static ${t} tlc2.module.Bags.${e}(${Array.from({length:n},()=>`tlc2.value.impl.Value`).join(`,`)})`,Uc=Hc(`BagDiff`,`tlc2.value.impl.Value`,2),Wc=Hc(`SqSubseteq`,`tlc2.value.IBoolValue`,2),Gc=Hc(`BagUnion`,`tlc2.value.impl.Value`,1),Kc=Hc(`BagOfAll`,`tlc2.value.impl.Value`,2),qc=Hc(`BagCup`,`tlc2.value.impl.Value`,2),Jc=Hc(`BagCardinality`,`tlc2.value.impl.IntValue`,1),Yc=(e,t)=>{if(typeof e==`number`)return e;let n=`tlc2.value.impl.${Xn(e)}`;throw Qn(t,`class ${n} cannot be cast to class tlc2.value.impl.IntValue (${n} and tlc2.value.impl.IntValue are in unnamed module of loader 'app')`)},Xc=(e,t,n)=>{let r=Yc(e,n)+Yc(t,n);if(Gn(r))throw Kn(`${e}+${t}`);return r},Zc=(e,t,n,r)=>{let i=Vc(n,e.domain[t]),a=Yc(e.range[t],r);return i===void 0?a:a-Yc(i,r)|0},Qc=(e,t)=>yt(e.reduce((e,n)=>(n.domain.forEach((r,i)=>{let a=e.find(e=>Re(e[0],r));a?a[1]=Xc(a[1],n.range[i],t):e.push([r,n.range[i]])}),e),[])),$c=F([],[]),el=[Vn(`EmptyBag`,$c),W(`IsABag`,1,e=>{let t=Ic(U(e,0,`IsABag`));return t!==void 0&&Bc(t)}),W(`BagCardinality`,1,e=>{let t=U(e,0,`BagCardinality`);return Lc(e,0,`BagCardinality`).range.reduce((e,n)=>{if(typeof n!=`number`||n<=0)throw Pc(`BagCardinality`,`a bag`,t);return Xc(e,n,Jc)},0)}),W(`BagIn`,2,e=>{let t=U(e,1,`BagIn`),n=Vc(Lc(e,1,`BagIn`),U(e,0,`BagIn`));if(n===void 0)return!1;if(typeof n!=`number`)throw Fc(`second`,`BagIn`,`bag`,t);return n>0}),W(`CopiesIn`,2,e=>{let t=U(e,1,`CopiesIn`),n=Vc(Lc(e,1,`CopiesIn`),U(e,0,`CopiesIn`));if(n===void 0)return 0;if(typeof n!=`number`)throw Fc(`second`,`CopiesIn`,`bag`,t);return n}),W(`\\oplus`,2,e=>{let t=[0,1].map(t=>{let n=Rc(e,t,`(+)`);if(!Bc(n))throw Fc(t===0?`first`:`second`,`(+)`,`bag`,U(e,t,`(+)`));return n});return Qc(t,qc)}),W(`\\ominus`,2,e=>{let t=Rc(e,0,`(-)`),n=Rc(e,1,`(-)`);return yt(t.domain.flatMap((e,r)=>{let i=Zc(t,r,n,Uc);return i>0?[[e,i]]:[]}))}),W(`BagUnion`,1,e=>{let t=U(e,0,`BagUnion`),n=zc(t,()=>Pc(`BagUnion`,`a finite enumerable set`,t));if(n.length<2)return n[0]??$c;let r=n.map(e=>{let n=Ic(e);if(!n)throw new p(`Attempted to apply BagUnion to the following set, whose\nelement is not a bag:\n${H(t)}`);return n});return Qc(r,Gc)}),W(`\\sqsubseteq`,2,e=>{let t=Lc(e,0,`\\sqsubseteq`),n=Lc(e,1,`\\sqsubseteq`);return t.domain.every((e,r)=>Zc(t,r,n,Wc)<=0)}),Hn(`BagOfAll`,2,e=>{let t=Bn(e,0,`BagOfAll`);if(t.literalBody!==void 0)throw new p(`The first argument of BagOfAll should be an operator, but instead it is:\n${H(t.literalBody)}`);let n=U(e,1,`BagOfAll`),r=Ic(n);if(!r)throw Fc(`second`,`BagOfAll`,`function with a finite domain`,n);return Qc(r.domain.map((e,n)=>F([t.call([e])],[r.range[n]])),Kc)}),W(`SubBag`,1,e=>{let t=U(e,0,`SubBag`);if(!k(t))throw new f(`DOMAIN expects a function but received ${H(t)}`);let n=V(t),r=pt(n.range).elements,i=r.find(e=>typeof e!=`number`);if(i!==void 0){let e=typeof r[0]!=`number`;throw new f(`The ${e?`first`:`second`} argument of >= should be an integer, but instead it is:\n${H(e?r[0]:i)}`)}let a=n.range.filter(e=>typeof e==`number`);if(a.some(e=>e<1))throw new f(`Attempted to apply a function to ${H(n)}, which is not in its domain`);return pt(n.domain.reduce((e,t,n)=>e.flatMap(e=>[e,...Array.from({length:a[n]},(n,r)=>[...e,[t,r+1]])]),[[]]).map(e=>F(e.map(e=>e[0]),e.map(e=>e[1]))))}),W(`BagToSet`,1,e=>en(Lc(e,0,`BagToSet`))),W(`SetToBag`,1,e=>{let t=U(e,0,`SetToBag`),n=zc(t,()=>Pc(`BagToSet`,`a function with a finite domain`,t));return F([...n],n.map(()=>1))})],tl=`public static tlc2.value.impl.StringValue tlc2.module.Json.toJsonArray(tlc2.value.IValue) throws java.io.IOException`,nl=`public static tlc2.value.impl.StringValue tlc2.module.Json.toJsonObject(tlc2.value.IValue) throws java.io.IOException`,rl=`public static synchronized tlc2.value.impl.BoolValue tlc2.module.Json.serialize(tlc2.value.impl.StringValue,tlc2.value.impl.Value) throws java.io.IOException`,il=`public static synchronized tlc2.value.impl.BoolValue tlc2.module.Json.ndSerialize(tlc2.value.impl.StringValue,tlc2.value.impl.Value) throws java.io.IOException`,al=`public static tlc2.value.IValue tlc2.module.Json.deserialize(tlc2.value.impl.StringValue) throws java.io.IOException`,ol=`public static tlc2.value.IValue tlc2.module.Json.ndDeserialize(tlc2.value.impl.StringValue) throws java.io.IOException`,sl=e=>{if(!k(e))return!1;let t=V(e).domain;return t.length>0&&t.every(e=>typeof e==`string`)},cl=(e,t)=>Qn(e,`Cannot convert value: unsupported value type tlc2.value.impl.${Xn(t)}`),ll=(e,t)=>Qn(e,`Cannot cast tlc2.value.impl.${Xn(t)} to tlc2.value.impl.StringValue`),ul=e=>JSON.stringify(e).replaceAll(`\u2028`,`\\u2028`).replaceAll(`\u2029`,`\\u2029`),dl=(e,t)=>{if(typeof e==`object`&&(e.kind===`InfiniteSet`||e.kind===`SequenceSet`))throw cl(t,e);return`[${R(e).elements.map(e=>pl(e,t)).join(`,`)}]`},fl=(e,t)=>{let n=V(e),r=qt(n);return r?`[${r.map(e=>pl(e,t)).join(`,`)}]`:`{${n.domain.map((e,r)=>`${ul(typeof e==`string`?e:H(e))}:${pl(n.range[r],t)}`).join(`,`)}}`},pl=(e,t)=>typeof e==`string`?ul(e):typeof e==`object`?e.kind===`ModelValue`?ul(e.name):O(e)?dl(e,t):fl(e,t):String(e),ml=e=>{if(O(e))return dl(e,tl);if(!k(e)||sl(e))throw cl(tl,e);return fl(e,tl)},hl=e=>{if(!k(e))throw cl(nl,e);return fl(e,nl)},gl=e=>{let[,t,n=`0`,r=``,i=`0`]=/^(-?)(\d+)(?:\.(\d*))?(?:[eE]([+-]?\d+))?$/.exec(e)??[],a=BigInt(n+r),o=Number(i)-r.length,s=o>=0?a*10n**BigInt(o):a/10n**BigInt(-o);return Number(BigInt.asIntN(32,t===`-`?-s:s))},_l=(e,t)=>{if(typeof e==`boolean`||typeof e==`number`)return e;if(typeof e==`string`)return M(e);if(Array.isArray(e))return I(e.map(e=>_l(e,t)));if(typeof e==`object`&&e)return kt(Object.entries(e).map(([e,n])=>[M(e),_l(n,t)]));throw Qn(t,`Cannot convert value: unsupported JSON value ${String(e)}`)},vl=(e,t)=>{if(e.trim()===``)return _l(null,t);try{return _l(JSON.parse(e,(e,t,n)=>typeof t==`number`?gl(n?.source??String(t)):t),t)}catch(e){throw e instanceof SyntaxError?Qn(t,e.message):e}},yl=(e,t)=>{if(typeof e!=`string`)throw ll(t,e);return e},bl=(e,t,n)=>{let r=e.readFile?.(t);if(r===void 0)throw Qn(n,`${t} (No such file or directory)`);return r},xl=e=>[Un(`ToJson`,1,e=>M(pl(U(e,0,`ToJson`),`public static tlc2.value.impl.StringValue tlc2.module.Json.toJson(tlc2.value.IValue) throws java.io.IOException`))),Un(`ToJsonArray`,1,e=>M(ml(U(e,0,`ToJsonArray`)))),Un(`ToJsonObject`,1,e=>M(hl(U(e,0,`ToJsonObject`)))),Un(`JsonSerialize`,2,t=>{let n=yl(U(t,0,`JsonSerialize`),rl),r=U(t,1,`JsonSerialize`);if(!qt(r)&&!sl(r))throw new p(`The second argument of JsonSerialize should be a sequence or record, but instead it is:\n${H(r)}`);return e.writeFile?.(n,pl(r,rl)),!0}),Un(`ndJsonSerialize`,2,t=>{let n=yl(U(t,0,`ndJsonSerialize`),il),r=U(t,1,`ndJsonSerialize`),i=qt(r);if(!i)throw new p(`The second argument of ndJsonSerialize should be a sequence, but instead it is:\n${H(r)}`);return e.writeFile?.(n,i.map(e=>`${pl(e,il)}\n`).join(``)),!0}),Un(`JsonDeserialize`,1,t=>{let n=yl(U(t,0,`JsonDeserialize`),al);return vl(bl(e,n,al),al)}),Un(`ndJsonDeserialize`,1,t=>{let n=yl(U(t,0,`ndJsonDeserialize`),ol);return I(bl(e,n,ol).split(/\r\n|\r|\n/).map(e=>e.trim()).filter(e=>e!==``).map(e=>vl(e,ol)))})],Sl=(e,t,n,r)=>new p(`The ${e} argument of ${t} should be a ${n}, but instead it is:\n${r}`),Cl=(e,t,n)=>{if(typeof e!=`number`||e<0)throw Sl(t,n,`nonnegative integer`,H(e));return e},wl=(e,t,n,r)=>{if(!O(e)||!L(e))throw Sl(t,n,r,H(e));return R(e).elements},Tl=(e,t,n,r)=>pt(Array.from({length:t},()=>pt(e.filter(()=>r.nextDouble()<n)))),El=(e,t)=>{let n=`RandomSetOfSubsets`,r=Cl(U(e,0,n),`first`,n),i=Cl(U(e,1,n),`second`,n),a=wl(U(e,2,n),`third`,n,`finite set`);if(a.length<31&&r>2**a.length)throw Sl(`first`,n,`nonnegative integer that is smaller than the subset's size of 2^${a.length}`,String(r));if(a.length<i)throw Sl(`second`,n,`nonnegative integer in range 0..Cardinality(S)`,String(i));return Tl(a,r,a.length===0?0:i/a.length,t.getRandom())},Dl=e=>[Un(`RandomSubset`,2,t=>{let n=U(t,0,`RandomSubset`);if(typeof n!=`number`)throw Sl(`first`,`RandomSubset`,`nonnegative integer`,H(n));if(n<0)throw new f(`Attempted to apply the operator overridden by the Java method\npublic static tlc2.value.impl.Value tlc2.module.Randomization.RandomSubset(tlc2.value.impl.Value,tlc2.value.impl.Value),\nbut it produced the following error:\n${n}`);let r=U(t,1,`RandomSubset`);if(!O(r)||!z(r)&&!L(r))throw Sl(`second`,`RandomSubset`,`a finite set`,H(r));return pt(Oc(n,r,e.getRandom()))}),Un(`RandomSetOfSubsets`,3,t=>El(t,e)),Un(`TestRandomSetOfSubsets`,3,t=>I(Array.from({length:5},()=>R(El(t,e)).elements.length)))],Ol=`tlc2.tool.impl.Tool,tla2sany.semantic.ExprOrOpArgNode[],tlc2.util.Context,tlc2.tool.TLCState,tlc2.tool.TLCState,int,tlc2.tool.coverage.CostModel`,kl=`public static synchronized tlc2.value.impl.Value tlc2.module.TLCExt.assertError(${Ol})`,Al=`public static tlc2.value.impl.TupleValue tlc2.module.TLCExt.getTrace(${Ol}) throws java.io.IOException`,jl=`public static synchronized tlc2.value.impl.Value tlc2.module.TLCExt.pickSuccessor(${Ol})`,Ml=()=>kt([[`action`,pt([])],[`state`,pt([])]]),Nl=()=>kt([[`beginLine`,0],[`beginColumn`,0],[`endLine`,0],[`endColumn`,0],[`module`,`--TLA+ BUILTINS--`]]),Pl=e=>kt([[`name`,e??`UnnamedAction`],[`location`,Nl()]]),Fl=(e,t)=>{let n=e.map((e,t)=>I([t+1,kt(Object.entries(e.state))])),r=n.slice(1).map((t,r)=>I([n[r],Pl(e[r+1].action),t])),i=t?[I([n[n.length-1],Pl(t.action),n[t.start]])]:[];return kt([[`action`,pt([...r,...i])],[`state`,pt(n)]])},Il=(e,t)=>{if(typeof t==`number`)return e.registers.get(t);if(typeof t==`string`&&t.startsWith(`s:`))return Nc(e).get(t)},Ll=(e,t,n)=>{if(typeof t==`number`&&t>=0)e.registers.set(t,n);else if(typeof t==`string`&&t.startsWith(`s:`))e.namedRegisters.set(t,n);else throw new p(`The first argument of TLCSet should be a nonnegative integer, but instead it is:\n${H(t)}`)},Rl=e=>e.every(e=>e!==void 0),zl=(e,t)=>kt(t.variables.map((t,n)=>[t,e[n]])),Bl=(e,t,n)=>{let r=e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0;if(e.kind===`Prime`||e.kind===`Unchanged`)return!0;if(r!==void 0&&!J(e)){if(t.variableIndex.has(r))return!0;let e=Wa(r,t);if(e&&!n.has(e)&&(n.add(e),Bl(e.body,t,n)))return!0}return Ua(e).some(e=>Bl(e,t,n))},Vl=(e,t)=>{let n=/* @__PURE__ */ new Map,r=/* @__PURE__ */ new WeakMap,i=e=>{let t=r.get(e)??/* @__PURE__ */ new Map;return r.set(e,t),t};return[W(`AssertEq`,2,t=>{let n=U(t,0,`AssertEq`),r=U(t,1,`AssertEq`),i=Re(n,r);return i||(e(H(`Assertion failed`,!0)),e(H(n,!0)),e(H(r,!0))),i}),ar(`AssertError`,2,e=>{let t=Bn(e,0,`AssertError`).expression;if(t&&t.kind!==`String`)throw Qn(kl,`In computing AssertError, a non-string expression (line ${t.location.line}, col ${t.location.column}) was used as the err of an AssertError(err, exp).`);let n=or(e,0,`AssertError`)();try{or(e,1,`AssertError`)()}catch(e){if(e instanceof f)return e.message===n;throw e}return!1}),Un(`TLCGetOrDefault`,2,e=>{let n=U(e,0,`TLCGetOrDefault`);return Il(t,n)??U(e,1,`TLCGetOrDefault`)}),{...Hn(`TLCGetAndSet`,4,e=>{let n=U(e,0,`TLCGetAndSet`),r=Il(t,n)??U(e,3,`TLCGetAndSet`),i=Bn(e,1,`TLCGetAndSet`);return Ll(t,n,i.call([r,U(e,2,`TLCGetAndSet`)])),r}),isStateLevel:!0},Un(`Trace`,0,(e,n)=>{let r=n?.state;if(!n||!r||!Rl(r)){let e=(n?.environment.variables??[]).filter((e,t)=>r?.[t]===void 0);throw Qn(Al,`In evaluating TLCExt!Trace, the state is not completely specified yet (variable${e.length>1?`s`:``} ${e.join(`, `)} undefined).`)}return I(t.getBehavior(r).map(e=>zl(e,n.environment)))}),Un(`CounterExample`,0,()=>t.counterExample??Ml()),W(`ToTrace`,1,e=>{let t=U(e,0,`ToTrace`);if(!k(t)||!Re(en(t),pt([`action`,`state`])))throw new f(`The argument of ToTrace should be a CounterExample, but instead it is:\n${H(t)}`);let n=R($t(t,`state`)).elements.map(e=>qt(e)??[]);return I(n.sort((e,t)=>Number(e[0])-Number(t[0])).map(e=>e[1]))}),W(`TLCModelValue`,1,e=>{let t=U(e,0,`TLCModelValue`);if(typeof t!=`string`)throw new p(`The argument of ModelValue should be a string, but instead it is:\n${H(t)}`);return Ie(t)}),ar(`TLCDefer`,1,()=>!0),W(`TLCNoOp`,1,e=>U(e,0,`TLCNoOp`)),ar(`PickSuccessor`,1,(e,n)=>{let r=n?.next;if(!r||!Rl(r))throw Qn(jl,`Cannot invoke "tlc2.value.IValue.fingerPrint(long)" because "minVals[i]" is null`);if(t.isSeen(r)||Ha(or(e,0,`PickSuccessor`)(),`the condition of PickSuccessor`))return!0;throw new m(`PickSuccessor needs interactive input to extend the behavior with a new state`)}),ar(`TLCCache`,2,(e,t)=>{let r=Bn(e,0,`TLCCache`),a=yn(or(e,1,`TLCCache`)()),o=r.expression;if(!o||!t)return r.call([]);let s=Bl(o,t.environment,/* @__PURE__ */ new Set)&&t.state?i(t.state):n,c=s.get(o)??/* @__PURE__ */ new Map;s.set(o,c);let l=c.get(a);if(l!==void 0)return l;let u=r.call([]);return c.set(a,u),u}),W(`TLCFP`,1,e=>Number(BigInt.asIntN(32,pc([U(e,0,`TLCFP`)])))),Un(`TLCEvalDefinition`,1,(e,t)=>{let n=U(e,0,`TLCEvalDefinition`),r=typeof n==`string`&&t?Wa(n,t.environment):void 0;if(!r||typeof n!=`string`||!t)throw new p(`The argument of TLCEvalDefinition should be a name of a definition reachable from the root module, but instead it is:\n${H(n)}`);if(r.kind===`Operator`&&r.params.length>0)throw new p(`The argument of TLCEvalDefinition should be a zero-arity definition, but instead it is:\n${n}`);return X({kind:`Identifier`,name:n,location:r.location},t)})]},Hl=(e,t)=>[Un(`_Track`,2,e=>{let n=String(U(e,1,`_Track`)),r=t.possibleCounts.get(n)??0;return t.possibleCounts.set(n,U(e,0,`_Track`)===!0?r+1:r),!0}),Un(`_Counts`,0,()=>Mc(t)),Un(`_CheckName`,1,n=>{let r=String(U(n,0,`_CheckName`));return t.possibleCounts.get(r)?!0:(e(H(Mc(t),!0)),!1)}),Un(`_PrintCounts`,0,()=>(e(H(Mc(t),!0)),!0))],Ul=e=>String(e).padStart(2,`0`),Wl=e=>`${e.getUTCFullYear()}.${Ul(e.getUTCMonth()+1)}.${Ul(e.getUTCDate())}.${Ul(e.getUTCHours())}${Ul(e.getUTCMinutes())}${Ul(e.getUTCSeconds())}`,Gl=e=>yt([...e].map(([e,t])=>[e,I([t])])),Kl=(e,t,n)=>{let r=Math.floor((Date.now()-e.startedAt)/1e3);switch(t){case`level`:return n===void 0?0:e.getLevel(n);case`diameter`:return e.diameter;case`generated`:return e.generatedStates;case`distinct`:return e.distinctStates;case`queue`:return e.queueSize;case`duration`:return r;case`stats`:return kt([[`queue`,e.queueSize],[`distinct`,e.distinctStates],[`initial`,e.initialStates],[`generated`,e.generatedStates],[`diameter`,e.diameter],[`duration`,r],[`worker`,0]]);case`config`:return kt([[`mode`,`bfs`],[`deadlock`,e.checkDeadlock],[`worker`,1],[`seed`,String(e.seed)],[`fingerprint`,`0`],[`install`,`unknown`]]);case`revision`:{let t=/* @__PURE__ */ new Date;return kt([[`count`,0],[`timestamp`,Math.floor(t.getTime()/1e3)],[`date`,M(`${t.toISOString().slice(0,19)}.${t.getUTCMilliseconds()}Z`)],[`tag`,`development`],[`calver`,M(Wl(new Date(e.startedAt)))]])}case`spec`:return e.getSpecification();case`action`:return Pl(void 0);case`all`:return Gl(e.registers);case`all:named`:return Gl(Nc(e))}if(t.startsWith(`s:`)){let n=Nc(e).get(t);if(n===void 0)throw new p(`TLCGet(${t}) was undefined.`);return n}if(t.startsWith(`-D`))return M(e.properties.get(t.slice(2))??t);throw new p(`TLCGet(${t}) was undefined.`)},ql=e=>e.length===0?[[]]:e.flatMap((t,n)=>ql([...e.slice(0,n),...e.slice(n+1)]).map(e=>[t,...e])),Jl=e=>{typeof e==`object`&&((e.kind===`Set`||e.kind===`MixedSet`)&&R(e).elements.forEach(Jl),e.kind===`Function`&&e.range.forEach(Jl))},Yl=(t,n)=>[W(`Print`,2,e=>(t(`${pe(H(U(e,0,`Print`),!0,!0))}  ${pe(H(U(e,1,`Print`),!0,!0))}`),U(e,1,`Print`))),W(`PrintT`,1,e=>(t(pe(H(U(e,0,`PrintT`),!0,!0))),!0)),W(`Assert`,2,t=>{if(U(t,0,`Assert`)!==!0)throw new p(`The first argument of Assert evaluated to FALSE; the second argument was:\n${pe(H(U(t,1,`Assert`)))}`,e.assertViolation);return!0}),W(`JavaTime`,0,()=>Math.floor(Date.now()/1e3)&2147483647),W(`:>`,2,e=>yt([[U(e,0,`:>`),U(e,1,`:>`)]])),W(`@@`,2,e=>{let t=zn(e,0,`@@`),n=zn(e,1,`@@`);return bt([...j(t),...j(n)])}),W(`ToString`,1,e=>M(H(U(e,0,`ToString`),!0))),W(`TLCEval`,1,e=>{let t=U(e,0,`TLCEval`);return Jl(t),t}),W(`Permutations`,1,e=>{let t=Ln(e,0,`Permutations`);return pt(ql(t).map(e=>yt(t.map((t,n)=>[t,e[n]]))))}),Hn(`SortSeq`,2,e=>{let t=Bn(e,1,`SortSeq`);return I(Rn(e,0,`SortSeq`).reduce((e,n)=>{let r=e.findIndex(e=>t.call([n,e])===!0);return r===-1?[...e,n]:[...e.slice(0,r),n,...e.slice(r)]},[]))}),Un(`TLCGet`,1,(e,t)=>{let r=U(e,0,`TLCGet`);if(typeof r==`number`&&r>=0){let e=n.registers.get(r);if(e===void 0)throw new p(`TLCGet(${r}) was undefined.`);return e}if(typeof r!=`string`)throw new p(`The argument of TLCGet should be a nonnegative integer, but instead it is:\n${H(r)}`);return Kl(n,r,t?.state)}),Un(`TLCSet`,2,e=>{let r=U(e,0,`TLCSet`),i=U(e,1,`TLCSet`);if(typeof r==`number`&&r>=0)return n.registers.set(r,i),!0;if(r===`exit`)return i===!0&&(n.isStopped=!0),!0;if(r===`pause`)return i===!0&&(t(`Press enter to resume model checking.`),n.pause()),!0;if(typeof r==`string`&&r.startsWith(`s:`))return n.namedRegisters.set(r,i),!0;if(typeof r==`string`&&r.startsWith(`-D`))return n.properties.set(r.slice(2),H(i)),!0;throw new p(`The first argument of TLCSet should be a nonnegative integer, but instead it is:\n${H(r)}`)}),Vn(`Any`,Ne),W(`RandomElement`,1,e=>Ac(Fn(e,0,`RandomElement`),n.getRandom()))],Xl=/* @__PURE__ */ `STRING,FALSE,TRUE,BOOLEAN,=,/=,.,',\\lnot,\\neg,\\land,\\lor,\\equiv,=>,SUBSET,UNION,DOMAIN,\\subseteq,\\in,\\notin,\\,\\intersect,\\union,\\times,~>,[],<>,ENABLED,UNCHANGED,\\cdot,-+->,$AngleAct,$BoundedChoose,$BoundedExists,$BoundedForall,$CartesianProd,$Case,$ConjList,$DisjList,$Except,$FcnApply,$FcnConstructor,$IfThenElse,$NonRecursiveFcnSpec,$Pair,$RcdConstructor,$RcdSelect,$RecursiveFcnSpec,$Seq,$SetEnumerate,$SetOfAll,$SetOfFcns,$SetOfRcds,$SF,$SquareAct,$SubsetOf,$TemporalExists,$TemporalForall,$TemporalWhile,$Tuple,$UnboundedChoose,$UnboundedExists,$UnboundedForall,$WF,$Nop,$Qed,$Pfcase,$Have,$Take,$Pick,$Witness,$Suffices`.split(`,`),Zl=[[`\\lnot`,`~`,`\\neg`,`¬`],[`[]`,`□`],[`<>`,`◇`],[`\\land`,`/\\`,`∧`],[`\\lor`,`\\/`,`∨`],[`\\equiv`,`<=>`,`≡`,`⇔`],[`/=`,`#`,`≠`],[`\\leq`,`<=`,`=<`,`≤`],[`\\geq`,`>=`,`≥`],[`\\times`,`\\X`,`×`],[`\\intersect`,`\\cap`,`∩`],[`\\union`,`\\cup`,`∪`],[`\\o`,`\\circ`,`∘`],[`\\oplus`,`(+)`,`⊕`],[`\\ominus`,`(-)`,`⊖`],[`\\odot`,`(.)`,`⊙`],[`\\oslash`,`(/)`,`⊘`],[`\\otimes`,`(\\X)`,`⊗`],[`\\approx`,`≈`],[`:=`,`≔`],[`\\asymp`,`≍`],[`\\bigcirc`,`◯`],[`::=`,`⩴`],[`\\bullet`,`●`],[`\\cdot`,`⋅`],[`\\cong`,`≅`],[`\\div`,`÷`],[`\\doteq`,`≐`],[`..`,`‥`],[`...`,`…`],[`!!`,`‼`],[`\\gg`,`≫`],[`=>`,`⇒`],[`\\in`,`∈`],[`=|`,`⫤`],[`~>`,`↝`],[`\\ll`,`≪`],[`-|`,`⊣`],[`\\notin`,`∉`],[`-+->`,`⇸`],[`\\prec`,`≺`],[`\\preceq`,`⪯`],[`\\propto`,`∝`],[`??`,`⁇`],[`|=`,`⊨`],[`|-`,`⊢`],[`\\sim`,`∼`],[`\\simeq`,`≃`],[`\\sqcap`,`⊓`],[`\\sqcup`,`⊔`],[`\\sqsubset`,`⊏`],[`\\sqsubseteq`,`⊑`],[`\\sqsupset`,`⊐`],[`\\sqsupseteq`,`⊒`],[`\\star`,`⋆`],[`\\subset`,`⊂`],[`\\subseteq`,`⊆`],[`\\succ`,`≻`],[`\\succeq`,`⪰`],[`\\supset`,`⊃`],[`\\supseteq`,`⊇`],[`\\uplus`,`⊎`],[`||`,`‖`],[`\\wr`,`≀`],[`^+`,`⁺`]],Ql=/* @__PURE__ */ `STRING,FALSE,TRUE,BOOLEAN,=,/=,.,',\\lnot,\\neg,\\land,\\lor,\\equiv,=>,SUBSET,UNION,DOMAIN,\\subseteq,\\in,\\notin,\\,\\intersect,\\union,\\times,~>,[],<>,ENABLED,UNCHANGED,\\cdot,-+->,$AngleAct,$BoundedChoose,$BoundedExists,$BoundedForall,$CartesianProd,$Case,$ConjList,$DisjList,$Except,$FcnApply,$FcnConstructor,$IfThenElse,$NonRecursiveFcnSpec,$Pair,$RcdConstructor,$RcdSelect,$RecursiveFcnSpec,$Seq,$SetEnumerate,$SetOfAll,$SetOfFcns,$SetOfRcds,$SF,$SquareAct,$SubsetOf,$TemporalExists,$TemporalForall,$TemporalWhile,$Tuple,$UnboundedChoose,$UnboundedExists,$UnboundedForall,$WF,$Nop,$Qed,$Pfcase,$Have,$Take,$Pick,$Witness,$Suffices,***I do not exist***,--TLA+ BUILTINS--,Formal_0,Formal_1,Formal_2,[,^,/,*,-,-.,+,^+,^*,^#,<,\\leq,>,\\geq,...,..,|,||,&&,&,$$,$,??,%%,%,##,++,--,**,//,^^,@@,!!,|-,|=,-|,=|,<:,:>,:=,::=,\\oplus,\\ominus,\\odot,\\oslash,\\otimes,\\uplus,\\sqcap,\\sqcup,\\div,\\wr,\\star,\\o,\\bigcirc,\\bullet,\\prec,\\succ,\\preceq,\\succeq,\\sim,\\simeq,\\ll,\\gg,\\asymp,\\subset,\\supset,\\supseteq,\\approx,\\cong,\\sqsubset,\\sqsubseteq,\\sqsupset,\\sqsupseteq,\\doteq,\\propto,~,¬,□,◇,/\\,∧,\\/,∨,<=>,≡,⇔,#,≠,<=,=<,≤,>=,≥,\\X,×,\\cap,∩,\\cup,∪,\\circ,∘,(+),⊕,(-),⊖,(.),⊙,(/),⊘,(\\X),⊗,≈,≔,≍,◯,⩴,●,⋅,≅,÷,≐,‥,…,‼,≫,⇒,∈,⫤,↝,≪,⊣,∉,⇸,≺,⪯,∝,⁇,⊨,⊢,∼,≃,⊓,⊔,⊏,⊑,⊐,⊒,⋆,⊂,⊆,≻,⪰,⊃,⊇,⊎,‖,≀,⁺,@`.split(`,`),$l=/* @__PURE__ */ `exit.pause.config.spec.coverage.action.install.id.behavior.all.mode.deadlock.seed.fingerprint.worker.traces.depth.aril.sched.revision.timestamp.date.count.tag.calver.impliedinits.impliedactions.invariants.impliedtemporals.temporals.actions.inits.variables.actionconstraints.constraints.stats.duration.generated.diameter.distinct.initial.queue.retries.distinctvalues.levelmean.levelvariance.bfs`.split(`.`),eu=/* @__PURE__ */ `Not a node.N_ActDecl.N_ActionExpr.N_AssumeDecl.N_AssumeProve.N_Assumption.N_BeginModule.N_Body.N_BoundedQuant.N_Case.N_CaseArm.N_CaseStatement.N_ChooseStatement.N_ConjItem.N_ConjList.N_ConsDecl.N_DisjItem.N_DisjList.N_EndModule.N_Except.N_ExceptComponent.N_ExceptSpec.N_Times.N_Extends.N_FairnessExpr.N_FcnAppl.N_FcnConst.N_FieldSet.N_FieldVal.N_FunctionDefinition.N_FunctionParam.N_GeneralId.N_GenInfixOp.N_GenNonExpPrefixOp.N_GenPostfixOp.N_GenPrefixOp.N_IdentDecl.N_Real.N_IdentifierTuple.N_IdentLHS.N_IdPrefix.N_IdPrefixElement.N_IfThenElse.N_InfixDecl.N_InfixExpr.N_InfixLHS.N_InfixOp.N_InnerProof.N_Instance.N_NonLocalInstance.N_Integer.N_LeafProof.N_LetDefinitions.N_LetIn.N_MaybeBound.N_Module.N_ModuleDefinition.N_NonExpPrefixOp.N_Number.N_NumberedAssumeProve.N_OpApplication.N_OpArgs.N_OperatorDefinition.N_OtherArm.N_ParamDecl.N_ParamDeclaration.N_ParenExpr.N_PostfixDecl.N_PostfixExpr.N_PostfixLHS.N_PostfixOp.N_PrefixDecl.N_PrefixExpr.N_PrefixLHS.N_PrefixOp.N_Proof.N_ProofLet.N_ProofName.N_ProofStatement.N_ProofStep.N_QEDStep.N_QuantBound.N_RcdConstructor.N_RecordComponent.N_SetEnumerate.N_SetOfAll.N_SetOfFcns.N_SetOfRcds.N_String.N_SubsetOf.N_Substitution.N_TempDecl.N_Theorem.N_Tuple.N_UnBoundedOrBoundedChoose.N_UnboundedQuant.N_VariableDeclaration.Token =.Token \\in.N_NewSymb.N_Lambda.N_Recursive.N_Label.N_StructOp.N_NumerableStep.N_TerminalProof.N_UseOrHide.N_NonExprBody.N_DefStep.N_HaveStep.N_TakeStep.N_WitnessStep.N_PickStep.N_CaseStep.N_AssertStep`.split(`.`),tu=/* @__PURE__ */ new Map([[`Naturals`,`-------------------------------- MODULE Naturals ----------------------------
+Nat       == { }
+a+b       == {a, b}
+a-b       == CHOOSE n : b + n = a
+a*b       == TRUE
+a^b       == {a, b}
+a<b       ==  a = b
+a>b       ==  a = b
+a \\leq b  ==  a = b
+a \\geq b  ==  a = b
+a % b     ==  {a, b}
+a \\div b  ==  {a, b}
+a .. b    ==  {a, b}
+=============================================================================
+`],[`Integers`,`-------------------------------- MODULE Integers ----------------------------
+EXTENDS Naturals
+Int  ==  { }
+-. a == 0 - a
+=============================================================================
+`],[`Sequences`,`------------------------------ MODULE Sequences -----------------------------
+LOCAL INSTANCE Naturals
+Seq(S) == UNION {[1..n -> S] : n \\in Nat}
+Len(s) == CHOOSE n \\in Nat : DOMAIN s = 1..n
+s \\o t == [i \\in 1..(Len(s) + Len(t)) |-> IF i \\leq Len(s) THEN s[i]
+                                                           ELSE t[i-Len(s)]]
+Append(s, e) == s \\o <<e>>
+Head(s) == s[1]
+Tail(s) == CASE s # << >> -> [i \\in 1..(Len(s)-1) |-> s[i+1]]
+SubSeq(s, m, n) == [i \\in 1..(1+n-m) |-> s[i+m-1]]
+SelectSeq(s, Test(_)) ==
+  LET F[i \\in 0..Len(s)] ==
+        IF i = 0 THEN << >>
+                 ELSE IF Test(s[i]) THEN Append(F[i-1], s[i])
+                                    ELSE F[i-1]
+  IN F[Len(s)]
+=============================================================================
+`],[`FiniteSets`,`---------------------------- MODULE FiniteSets -----------------------------
+LOCAL INSTANCE Naturals
+LOCAL INSTANCE Sequences
+IsFiniteSet(S) ==
+  \\E seq \\in Seq(S) : \\A s \\in S : \\E n \\in 1..Len(seq) : seq[n] = s
+Cardinality(S) ==
+  LET CS[T \\in SUBSET S] == IF T = {} THEN 0
+                                      ELSE 1 + CS[T \\ {CHOOSE x : x \\in T}]
+  IN  CS[S]
+=============================================================================
+`],[`TLC`,`------------------------------- MODULE TLC ----------------------------------
+LOCAL INSTANCE Naturals
+LOCAL INSTANCE Sequences
+LOCAL INSTANCE FiniteSets
+-----------------------------------------------------------------------------
+Print(out, val) == val
+PrintT(out) == TRUE
+Assert(val, out) == IF val = TRUE THEN TRUE
+                                  ELSE CHOOSE v : TRUE
+JavaTime == CHOOSE n : n \\in Nat
+TLCGet(i) == CHOOSE n : TRUE
+TLCSet(i, v) == TRUE
+-----------------------------------------------------------------------------
+d :> e == [x \\in {d} |-> e]
+f @@ g == [x \\in (DOMAIN f) \\cup (DOMAIN g) |->
+            IF x \\in DOMAIN f THEN f[x] ELSE g[x]]
+Permutations(S) ==
+   {f \\in [S -> S] : \\A w \\in S : \\E v \\in S : f[v]=w}
+-----------------------------------------------------------------------------
+SortSeq(s, Op(_, _)) ==
+    LET Perm == CHOOSE p \\in Permutations(1 .. Len(s)) :
+                  \\A i, j \\in 1..Len(s) :
+                     (i < j) => Op(s[p[i]], s[p[j]]) \\/ (s[p[i]] = s[p[j]])
+    IN  [i \\in 1..Len(s) |-> s[Perm[i]]]
+RandomElement(s) == CHOOSE x \\in s : TRUE
+Any == CHOOSE x : TRUE
+ToString(v) == (CHOOSE x \\in [a : v, b : STRING] : TRUE).b
+TLCEval(v) == v
+=============================================================================
+`],[`TLCExt`,`------------------------------- MODULE TLCExt -------------------------------
+LOCAL INSTANCE TLC
+LOCAL INSTANCE Integers
+-----------------------------------------------------------------------------
+AssertEq(a, b) ==
+    IF a # b THEN
+        /\\ PrintT("Assertion failed")
+        /\\ PrintT(a)
+        /\\ PrintT(b)
+        /\\ a = b
+    ELSE a = b
+AssertError(err, exp) ==
+    LET FailsEval(e) == CHOOSE b \\in BOOLEAN : TRUE
+        TLCError     == CHOOSE s \\in STRING  : TRUE
+    IN IF FailsEval(exp) THEN Assert(err = TLCError, TLCError) ELSE TRUE
+-----------------------------------------------------------------------------
+TLCGetOrDefault(key, defaultVal) ==
+  CHOOSE n : TRUE
+TLCGetAndSet(key, Op(_,_), val, defaultVal) ==
+  LET oldVal == TLCGetOrDefault(key, defaultVal)
+  IN CHOOSE v \\in {oldVal} : TLCSet(key, Op(oldVal, val))
+-----------------------------------------------------------------------------
+Trace ==
+  TRUE
+-----------------------------------------------------------------------------
+CounterExample ==
+    TRUE
+ToTrace(CE) ==
+	TRUE
+-----------------------------------------------------------------------------
+TLCModelValue(str) ==
+  CHOOSE v: ToString(v) = str
+TLCDefer(expression) ==
+  TRUE
+-----------------------------------------------------------------------------
+TLCNoOp(val) ==
+  val
+PickSuccessor(exp) ==
+  IF (exp)
+  THEN TRUE
+  ELSE CHOOSE bool \\in BOOLEAN : TRUE
+-----------------------------------------------------------------------------
+TLCCache(expression, closure) ==
+  expression
+TLCFP(var) ==
+  CHOOSE i \\in Int: TRUE
+-----------------------------------------------------------------------------
+TLCEvalDefinition(definitionName) ==
+  TRUE
+============================================================================
+`],[`Bags`,`----------------------------- MODULE Bags --------------------------------
+LOCAL INSTANCE Naturals
+IsABag(B) ==
+  B \\in [DOMAIN B -> {n \\in Nat : n > 0}]
+BagToSet(B) == DOMAIN B
+SetToBag(S) == [e \\in S |-> 1]
+BagIn(e,B) == e \\in BagToSet(B)
+EmptyBag == SetToBag({})
+B1 (+) B2  ==
+  [e \\in (DOMAIN B1) \\cup (DOMAIN B2) |->
+      (IF e \\in DOMAIN B1 THEN B1[e] ELSE 0)
+    + (IF e \\in DOMAIN B2 THEN B2[e] ELSE 0) ]
+B1 (-) B2  ==
+  LET B == [e \\in DOMAIN B1 |-> IF e \\in DOMAIN B2 THEN B1[e] - B2[e]
+                                                   ELSE B1[e]]
+  IN  [e \\in {d \\in DOMAIN B : B[d] > 0} |-> B[e]]
+LOCAL Sum(f) ==
+        LET DSum[S \\in SUBSET DOMAIN f] ==
+               LET elt == CHOOSE e \\in S : TRUE
+               IN  IF S = {} THEN 0
+                             ELSE f[elt] + DSum[S \\ {elt}]
+        IN  DSum[DOMAIN f]
+BagUnion(S) ==
+  [e \\in UNION {BagToSet(B) : B \\in S} |->
+    Sum( [B \\in S |-> IF BagIn(e, B) THEN B[e] ELSE 0] ) ]
+B1 \\sqsubseteq B2  ==
+  /\\ (DOMAIN B1) \\subseteq (DOMAIN B2)
+  /\\ \\A e \\in DOMAIN B1 : B1[e] \\leq B2[e]
+SubBag(B) ==
+  LET RemoveFromDom(x, f) == [y \\in (DOMAIN f) \\ {x} |-> f[y]]
+      Combine(x, BagSet) ==
+         BagSet \\cup
+          {[y \\in (DOMAIN f) \\cup {x} |-> IF y = x THEN i ELSE f[y]] :
+                f \\in BagSet, i \\in 1..B[x]}
+      Biggest == LET Range == {B[x] : x \\in DOMAIN B}
+                 IN  IF Range = {} THEN 0
+                                   ELSE CHOOSE r \\in Range :
+                                           \\A s \\in Range : r \\geq s
+      RSB[BB \\in UNION {[S -> 1..Biggest] : S \\in SUBSET DOMAIN B}] ==
+        IF BB = << >> THEN {<< >>}
+                      ELSE LET x == CHOOSE x \\in DOMAIN BB : TRUE
+                           IN  Combine(x, RSB[RemoveFromDom(x, BB)])
+  IN RSB[B]
+BagOfAll(F(_), B) ==
+  [e \\in {F(d) : d \\in BagToSet(B)} |->
+     Sum( [d \\in BagToSet(B) |-> IF F(d) = e THEN B[d] ELSE 0] ) ]
+BagCardinality(B) ==
+  Sum(B)
+CopiesIn(e, B) ==
+  IF BagIn(e, B) THEN B[e] ELSE 0
+=============================================================================
+ 6 Apr 99 : Modified version for standard module set
+ 7 Dec 98 : Corrected error found by Stephan Merz.
+ 6 Dec 98 : Modified comments based on suggestions by Lyle Ramshaw.
+ 5 Dec 98 : Initial version.
+`],[`Json`,`-------------------------------- MODULE Json --------------------------------
+LOCAL INSTANCE Sequences
+LOCAL INSTANCE FiniteSets
+LOCAL INSTANCE TLC
+-----------------------------------------------------------------------------
+LOCAL IsSequence(F, D) == TRUE \\/ FALSE
+LOCAL ToJsonKeyValue(F, d) ==
+  ToString(ToString(d)) \\o ":" \\o ToString(F[d])
+RECURSIVE ToJsonObjectString(_,_)
+LOCAL ToJsonObjectString(F, D) ==
+  LET d == CHOOSE d \\in D: TRUE
+  IN IF D = DOMAIN F
+     THEN "{" \\o ToJsonKeyValue(F, d) \\o IF D \\ {d} = {}
+                                         THEN "}"
+                                         ELSE ToJsonObjectString(F, D \\ {d})
+     ELSE ", " \\o ToJsonKeyValue(F, d) \\o IF D \\ {d} = {}
+                                          THEN "}"
+                                          ELSE ToJsonObjectString(F, D \\ {d})
+RECURSIVE ToJsonArrayString(_,_)
+LOCAL ToJsonArrayString(F, D) ==
+  LET d == CHOOSE d \\in D: TRUE
+  IN IF D = DOMAIN F
+     THEN "[" \\o ToString(F[d]) \\o IF D \\ {d} = {}
+                                   THEN "]"
+                                   ELSE ToJsonArrayString(F, D \\ {d})
+     ELSE ", " \\o ToString(F[d]) \\o IF D \\ {d} = {}
+                                    THEN "]"
+                                    ELSE ToJsonArrayString(F, D \\ {d})
+RECURSIVE ToJsonString(_,_)
+LOCAL ToJsonString(F, D) ==
+  IF IsFiniteSet(F) \\/ IsSequence(F, D) THEN
+    ToJsonArrayString(F, D)
+  ELSE
+    ToJsonObjectString(F, D)
+ToJson(value) ==
+  IF DOMAIN value = {} THEN
+    "{}"
+  ELSE
+    ToJsonString(value, DOMAIN value)
+ToJsonArray(value) ==
+  IF DOMAIN value = {} THEN
+    "[]"
+  ELSE
+    ToJsonArrayString(value, DOMAIN value)
+ToJsonObject(value) ==
+  IF DOMAIN value = {} THEN
+    "{}"
+  ELSE
+    ToJsonObjectString(value, DOMAIN value)
+JsonSerialize(absoluteFilename, value) ==
+  TRUE
+JsonDeserialize(absoluteFilename) ==
+  CHOOSE val : TRUE
+ndJsonSerialize(absoluteFilename, value) ==
+  TRUE
+ndJsonDeserialize(absoluteFilename) ==
+  CHOOSE val : TRUE
+=============================================================================
+`],[`Randomization`,`-------------------------- MODULE Randomization------------------------------
+LOCAL INSTANCE Naturals
+LOCAL INSTANCE FiniteSets
+RandomSubset(k, S) == CHOOSE T \\in SUBSET S : Cardinality(T) = k
+RandomSetOfSubsets(k, n, S) == CHOOSE T \\in SUBSET SUBSET S :
+                                              Cardinality(T) \\leq k
+TestRandomSetOfSubsets(k, n, S) ==
+              [i \\in 1..5 |-> Cardinality(RandomSetOfSubsets(k, n, S))]
+=============================================================================
+`],[`Reals`,`-------------------------------- MODULE Reals -------------------------------
+EXTENDS Integers
+Real  == "Reals"
+a / b == CHOOSE m \\in Real : m * b = a
+Infinity == CHOOSE i : (i \\notin Real) /\\ (\\A r \\in Real : i > r)
+=============================================================================
+`],[`RealTime`,`----------------------------- MODULE RealTime -------------------------------
+EXTENDS Reals
+VARIABLE now
 RTBound(A, v, D, E) ==
-  LET TNext(timer) == timer' = IF <<A>>_v \\/ ~(ENABLED <<A>>_v)'
-                               THEN 0
-                               ELSE timer + (now' - now)
-      Timer(timer) == (timer = 0) /\\ [][TNext(timer)]_<<timer, v, now>>
-      MaxTime(timer) == [](timer \\leq E)
-      MinTime(timer) == [][A => timer \\geq D]_v
-  IN \\EE timer : Timer(timer) /\\ MaxTime(timer) /\\ MinTime(timer)
-
-RTnow(v) == LET NowNext == /\\ now' \\in {real \\in Real : real > now}
+  LET TNext(t)  ==  t' = IF <<A>>_v \\/ ~(ENABLED <<A>>_v)'
+                           THEN 0
+                           ELSE t + (now'-now)
+      Timer(t) == (t=0)  /\\  [][TNext(t)]_<<t, v, now>>
+      MaxTime(t) == [](t \\leq E)
+      MinTime(t) == [][A => t \\geq D]_v
+  IN \\EE t : Timer(t) /\\ MaxTime(t) /\\ MinTime(t)
+-----------------------------------------------------------------------------
+RTnow(v) == LET NowNext == /\\ now' \\in {r \\in Real : r > now}
                            /\\ UNCHANGED v
-            IN /\\ now \\in Real
-               /\\ [][NowNext]_now
-               /\\ \\A real \\in Real : WF_now(NowNext /\\ (now' > real))
-====`],[`Toolbox`,`---- MODULE Toolbox ----
+            IN  /\\ now \\in Real
+                /\\ [][NowNext]_now
+                /\\ \\A r \\in Real : WF_now(NowNext /\\ (now'>r))
+=============================================================================
+`],[`Toolbox`,`----------------------------- MODULE Toolbox --------------------------------
 LOCAL INSTANCE Naturals
 LOCAL INSTANCE FiniteSets
 LOCAL INSTANCE TLC
-
-_TETrace == CHOOSE trace \\in [(Nat \\ {0}) -> STRING] : TRUE
-
+-----------------------------------------------------------------------------
+_TETrace ==
+    CHOOSE f \\in [ (Nat \\ {0}) -> STRING ] : TRUE
 LOCAL _TETraceLength == Cardinality(DOMAIN _TETrace)
-
 _TEPosition ==
-  IF TLCGet("level") >= _TETraceLength
-  THEN _TETraceLength
-  ELSE IF TLCGet("level") = 0 THEN 1 ELSE TLCGet("level")
-====`]]),G=(e,t,n)=>({low:e,high:t,isAssociative:n}),Qr=new Map([[`=>`,G(1,1,!1)],[`<=>`,G(2,2,!1)],[`~>`,G(2,2,!1)],[`-+->`,G(2,2,!1)],[`/\\`,G(3,3,!0)],[`\\/`,G(3,3,!0)],...(/* @__PURE__ */ `=.#.<.>.<=.>=.\\in.\\notin.\\subseteq.\\subset.\\supseteq.\\supset.\\sqsubseteq.\\sqsupseteq.\\sqsubset.\\sqsupset.\\prec.\\preceq.\\succ.\\succeq.\\sim.\\simeq.\\approx.\\cong.\\asymp.\\doteq.\\propto.\\ll.\\gg.|-.-|.|=.=|.:=.::=`.split(`.`)).map(e=>[e,G(5,5,!1)]),[`\\cdot`,G(5,14,!0)],[`@@`,G(6,6,!0)],[`:>`,G(7,7,!1)],[`<:`,G(7,7,!1)],[`\\cup`,G(8,8,!0)],[`\\cap`,G(8,8,!0)],[`\\`,G(8,8,!1)],[`..`,G(9,9,!1)],[`...`,G(9,9,!1)],[`##`,G(9,13,!0)],[`$`,G(9,13,!0)],[`$$`,G(9,13,!0)],[`??`,G(9,13,!0)],[`!!`,G(9,13,!1)],[`\\sqcap`,G(9,13,!0)],[`\\sqcup`,G(9,13,!0)],[`\\uplus`,G(9,13,!0)],[`\\wr`,G(9,14,!1)],[`+`,G(10,10,!0)],[`++`,G(10,10,!0)],[`(+)`,G(10,10,!0)],[`\\oplus`,G(10,10,!0)],[`%`,G(10,11,!1)],[`%%`,G(10,11,!0)],[`|`,G(10,11,!0)],[`||`,G(10,11,!0)],[`\\X`,G(10,13,!1)],[`-`,G(11,11,!0)],[`--`,G(11,11,!0)],[`(-)`,G(11,11,!0)],[`\\ominus`,G(11,11,!0)],[`*`,G(13,13,!0)],[`**`,G(13,13,!0)],[`/`,G(13,13,!1)],[`//`,G(13,13,!1)],[`\\div`,G(13,13,!1)],[`\\o`,G(13,13,!0)],[`(.)`,G(13,13,!0)],[`\\odot`,G(13,13,!0)],[`(/)`,G(13,13,!1)],[`\\oslash`,G(13,13,!1)],[`(\\X)`,G(13,13,!0)],[`\\otimes`,G(13,13,!0)],[`&`,G(13,13,!0)],[`&&`,G(13,13,!0)],[`\\star`,G(13,13,!0)],[`\\bullet`,G(13,13,!0)],[`\\bigcirc`,G(13,13,!0)],[`^`,G(14,14,!1)],[`^^`,G(14,14,!1)]]),$r=/* @__PURE__ */ new Set([`^+`,`^*`,`^#`]),ei=/* @__PURE__ */ new Set([`-`,`~`,`-.`]),ti=/* @__PURE__ */ new Set([`SUBSET`,`UNION`,`DOMAIN`,`ENABLED`,`UNCHANGED`,`[]`,`<>`,`'`,...$r]),ni=(e,t,n)=>{switch(e){case`ENABLED`:return{kind:`Enabled`,expression:t,location:n};case`UNCHANGED`:return{kind:`Unchanged`,expression:t,location:n};case`[]`:return{kind:`Always`,expression:t,location:n};case`<>`:return{kind:`Eventually`,expression:t,location:n};case`'`:return{kind:`Prime`,expression:t,location:n};default:return{kind:`Apply`,operator:e,args:[t],location:n}}},ri=/* @__PURE__ */ new Set([`<<`,`>>`,`:`,`@`,`(`]),ii=/* @__PURE__ */ new Set([`ASSUME`,`ASSUMPTION`,`AXIOM`,`CONSTANT`,`CONSTANTS`,`COROLLARY`,`INSTANCE`,`LEMMA`,`LOCAL`,`PROPOSITION`,`RECURSIVE`,`THEOREM`,`VARIABLE`,`VARIABLES`]),ai=/* @__PURE__ */ new Set([`THEOREM`,`LEMMA`,`COROLLARY`,`PROPOSITION`]),oi=/* @__PURE__ */ new Set([`BY`,`OBVIOUS`,`OMITTED`,`QED`,`USE`,`HIDE`]),si=e=>{let n=g(e),r={index:0,limit:n.length,offsideColumns:[]},i=/* @__PURE__ */ new Set,a=e=>({line:e.line,column:e.column}),o=(e=0)=>n[Math.min(r.index+e,n.length-1)],s=(e=0)=>{let t=r.index+e>=r.limit?{...o(e),kind:`End`,text:``}:o(e),n=r.offsideColumns[r.offsideColumns.length-1];return n===void 0||n===-1||t.kind===`End`?t:t.column<=n?{...t,kind:`End`,text:``}:t},c=e=>e.kind===`End`?`end of input`:`${JSON.stringify(e.text)}`,l=(e,n=o())=>new t(`${e} at line ${n.line}, column ${n.column}`),u=e=>e.kind===`Identifier`||e.kind===`Keyword`,d=(e,t=0)=>{let n=s(t);return n.text===e&&n.kind!==`String`&&n.kind!==`End`},f=()=>{let e=s();if(e.kind===`End`)throw l(`Unexpected end of expression`);return r.index++,e},p=e=>d(e)?(r.index++,!0):!1,m=e=>{if(!d(e))throw l(`Expected ${JSON.stringify(e)} but found ${c(s())}`);return f()},h=()=>{let e=s();if(e.kind!==`Identifier`)throw l(`Expected an identifier but found ${c(e)}`);return r.index++,e.text},_=e=>{r.offsideColumns.push(-1);let t=e();return r.offsideColumns.pop(),t},v=(e,t=`,`)=>{let n=[e()];for(;p(t);)n.push(e());return n},y=()=>{if(d(`<<`)){let e={value:1};for(;s(e.value).kind===`Identifier`||d(`,`,e.value);)e.value++;return d(`>>`,e.value)&&d(`\\in`,e.value+1)}let e={value:0};for(;s(e.value).kind===`Identifier`;){if(d(`\\in`,e.value+1))return!0;if(!d(`,`,e.value+1))return!1;e.value+=2}return!1},ee=()=>{if(d(`::`))return!0;if(!d(`(`))return!1;let e={value:1};for(;s(e.value).kind===`Identifier`&&d(`,`,e.value+1);)e.value+=2;return s(e.value).kind===`Identifier`&&d(`)`,e.value+1)&&d(`::`,e.value+2)},b=()=>{if(!p(`<<`))return{kind:`Name`,name:h()};let e=v(h);return m(`>>`),{kind:`Tuple`,names:e}},x=()=>v(()=>{let e=v(b);m(`\\in`);let t=k();return e.map(e=>({pattern:e,set:t}))}).flat(),S=()=>{let e=s();if(e.kind===`Identifier`)return r.index++,{kind:`Identifier`,name:e.text,location:a(e)};if(d(`<<`)||d(`(`))return D();throw l(`Expected a subscript but found ${c(e)}`)},C=()=>{let e=s(),t=s(1);if(e.kind===`Operator`&&(Qr.has(e.text)||ei.has(e.text))&&(t.text===`,`||t.text===`)`))return r.index++,{kind:`OperatorReference`,operator:e.text,location:a(e)};if(ti.has(e.text)&&(t.text===`,`||t.text===`)`)){r.index++;let t=a(e);if($r.has(e.text))return{kind:`OperatorReference`,operator:e.text,location:t};let n={kind:`Identifier`,name:`argument`,location:t};return{kind:`Lambda`,params:[n.name],body:ni(e.text,n,t),location:t}}if(d(`LAMBDA`)){f();let t=v(h);return m(`:`),{kind:`Lambda`,params:t,body:k(),location:a(e)}}return k()},w=()=>_(()=>{m(`(`);let e=v(C);return m(`)`),e}),te=()=>{let e=f();r.offsideColumns.push(e.column);let t=[k()];for(;o().text===e.text&&o().column===e.column;)r.index++,t.push(k());return r.offsideColumns.pop(),{kind:e.text===`/\\`?`And`:`Or`,operands:t,location:a(e)}},ne=e=>_(()=>{let t=a(e);if(s().kind===`Identifier`&&(d(`|->`,1)||d(`:`,1))){let e=d(`|->`,1)?`Record`:`RecordSet`,n=v(()=>{let t=h();return m(e===`Record`?`|->`:`:`),{name:t,value:k()}});return m(`]`),{kind:e,fields:n,location:t}}if(y()){let e=x();m(`|->`);let n=k();return m(`]`),{kind:`FunctionConstruction`,bounds:e,body:n,location:t}}let n=k();if(p(`->`)){let e=k();return m(`]`),{kind:`FunctionSet`,domain:n,range:e,location:t}}if(p(`EXCEPT`)){let e=v(()=>{m(`!`);let e=[];for(;d(`.`)||d(`[`);)if(p(`.`)){if(!u(s()))throw l(`Expected a field name but found ${c(s())}`);e.push({kind:`Field`,name:f().text})}else m(`[`),e.push({kind:`Index`,args:v(()=>k())}),m(`]`);return m(`=`),{path:e,value:k()}});return m(`]`),{kind:`Except`,function:n,updates:e,location:t}}return m(`]_`),{kind:`BoxAction`,action:n,subscript:S(),location:t}}),re=e=>_(()=>{let t=a(e);if(p(`}`))return{kind:`SetEnumeration`,elements:[],location:t};if(y()&&(s(1).text===`\\in`||d(`<<`))){let e=r.index,n=b();m(`\\in`);let i=k();if(p(`:`)){let e=k();return m(`}`),{kind:`SetFilter`,bound:{pattern:n,set:i},predicate:e,location:t}}r.index=e}let n=k();if(p(`:`)){let e=x();return m(`}`),{kind:`SetMap`,expression:n,bounds:e,location:t}}let i=[n];for(;p(`,`);)i.push(k());return m(`}`),{kind:`SetEnumeration`,elements:i,location:t}}),ie=e=>{let t=a(e),n=_(()=>d(`>>`)||d(`>>_`)?[]:v(()=>k()));if(p(`>>_`)){if(n.length!==1)throw l(`Expected a single action inside <<A>>_v`,e);return{kind:`AngleAction`,action:n[0],subscript:S(),location:t}}return m(`>>`),{kind:`Tuple`,elements:n,location:t}},ae=e=>{let t=a(e),n=e.text===`\\A`?`Forall`:`Exists`,r=e.text===`\\AA`||e.text===`\\EE`;if(!r&&y()){let e=x();return m(`:`),{kind:n,bounds:e,body:k(),location:t}}let i=v(h);return m(`:`),{kind:`UnboundedQuantifier`,names:i,body:k(),isTemporal:r,location:t}},T=e=>{let t=[],n={value:void 0};do{if(p(`OTHER`)){m(`->`),n.value=k();break}let e=k();m(`->`),t.push({condition:e,body:k()})}while(p(`[]`));return{kind:`Case`,arms:t,other:n.value,location:a(e)}},E=()=>{let e=s(1);return d(`!`)&&(e.kind===`Identifier`||e.kind===`Number`||ri.has(e.text)||e.kind===`Operator`&&(Qr.has(e.text)||$r.has(e.text)||ei.has(e.text)))},oe=()=>{let e=f();if(e.kind===`Number`)return{kind:`Operand`,operand:Number(e.text)};switch(e.text){case`<<`:case`>>`:return{kind:`Operand`,operand:e.text};case`:`:return{kind:`Colon`};case`@`:return{kind:`At`};case`(`:return r.index--,{kind:`Bound`,args:w()}}return{kind:`Name`,name:e.text,args:d(`(`)?w():[]}},D=()=>{let e=f(),t=a(e);if(e.kind===`Number`)return{kind:`Number`,value:Number(e.text),location:t};if(e.kind===`String`)return{kind:`String`,value:e.text,location:t};if(e.kind===`Identifier`){if(ee()){let n=p(`(`)?v(h):[];return n.length>0&&m(`)`),m(`::`),{kind:`Label`,name:e.text,params:n,body:k(),location:t}}let n=d(`(`),r=n?w():[];if(!E())return n?{kind:`Apply`,operator:e.text,args:r,location:t}:{kind:`Identifier`,name:e.text,location:t};let i=[{kind:`Name`,name:e.text,args:r}];for(;E();)f(),i.push(oe());let a=i.flatMap(e=>e.kind===`Name`?[e.name]:[]);if(a.length<i.length)return{kind:`Subexpression`,selectors:i,location:t};let o=a.join(`!`),s=i.flatMap(e=>`args`in e?e.args:[]);return s.length>0?{kind:`Apply`,operator:o,args:s,location:t}:{kind:`Identifier`,name:o,location:t}}let n=Qr.has(e.text)||$r.has(e.text)||e.text===`-.`;if(e.kind===`Operator`&&n&&d(`(`))return{kind:`Apply`,operator:e.text,args:w(),location:t};switch(e.text){case`(`:{let e=_(()=>k());return m(`)`),e}case`[`:return ne(e);case`{`:return re(e);case`<<`:return ie(e);case`@`:return{kind:`ExceptAt`,location:t};case`\\A`:case`\\E`:case`\\AA`:case`\\EE`:return ae(e);case`IF`:{let e=k();m(`THEN`);let n=k();return m(`ELSE`),{kind:`If`,condition:e,consequent:n,alternative:k(),location:t}}case`CASE`:return T(e);case`LET`:{let e=[],n=[];for(;!p(`IN`);){if(p(`RECURSIVE`)){A().forEach(e=>i.add(e.name));continue}let t=ce(!1);t.kind===`Instance`?n.push(t):e.push(t)}let r=k();return n.length===0?{kind:`Let`,definitions:e,body:r,location:t}:{kind:`Let`,definitions:e,instances:n,body:r,location:t}}case`CHOOSE`:{let e=b(),n=p(`\\in`)?k():void 0;return m(`:`),{kind:`Choose`,pattern:e,set:n,body:k(),location:t}}case`WF_`:case`SF_`:{let n=S(),r=_(()=>{m(`(`);let e=k();return m(`)`),e});return{kind:e.text===`WF_`?`WeakFairness`:`StrongFairness`,subscript:n,action:r,location:t}}}throw l(`Unexpected ${c(e)}`,e)},O=()=>{let e=s(),t=a(e);if(e.kind===`Operator`&&(e.text===`/\\`||e.text===`\\/`))return te();if(e.kind===`Operator`||e.kind===`Keyword`)switch(e.text){case`~`:return f(),{kind:`Apply`,operator:`~`,args:[k(5)],location:t};case`-`:return f(),{kind:`Apply`,operator:`-.`,args:[k(13)],location:t};case`[]`:return f(),{kind:`Always`,expression:k(16),location:t};case`<>`:return f(),{kind:`Eventually`,expression:k(16),location:t};case`ENABLED`:return f(),{kind:`Enabled`,expression:k(16),location:t};case`UNCHANGED`:return f(),{kind:`Unchanged`,expression:k(16),location:t};case`SUBSET`:case`UNION`:case`DOMAIN`:return f(),{kind:`Apply`,operator:e.text,args:[k(9)],location:t}}return D()},k=(e=0)=>{let t={left:O(),previous:void 0};for(;;){let n=s();if(n.kind!==`Operator`)break;let r=a(n);if(n.text===`'`&&e<=15){f(),t.left={kind:`Prime`,expression:t.left,location:r};continue}if($r.has(n.text)&&e<=15){f(),t.left={kind:`Apply`,operator:n.text,args:[t.left],location:r};continue}if(n.text===`[`){f();let e=_(()=>v(()=>k()));_(()=>m(`]`)),t.left={kind:`FunctionApplication`,function:t.left,args:e,location:r};continue}if(n.text===`.`&&u(s(1))){f(),t.left={kind:`FieldAccess`,record:t.left,field:f().text,location:r};continue}let i=Qr.get(n.text);if(!i||i.low<e)break;let o=t.previous;if(o){let e=!(o.low>i.high||o.high<i.low),t=o.text===n.text&&i.isAssociative;if(e&&!t&&(o.text!==`\\X`||n.text!==`\\X`))throw l(`Precedence conflict between ${o.text} and ${n.text}`,n)}f();let c=k(i.high+1),d=t.left;if(n.text===`/\\`||n.text===`\\/`){let e=n.text===`/\\`?`And`:`Or`;t.left=d.kind===e&&o?.text===n.text?{...d,operands:[...d.operands,c]}:{kind:e,operands:[d,c],location:r}}else t.left=n.text===`\\X`?d.kind===`Product`&&o?.text===`\\X`?{...d,factors:[...d.factors,c]}:{kind:`Product`,factors:[d,c],location:r}:{kind:`Apply`,operator:n.text,args:[d,c],location:r};t.previous={...i,text:n.text}}return t.left},se=()=>{if(!p(`(`))return[];let e=A();return m(`)`),e},ce=e=>{let t=s(),n=a(t);if(t.kind===`Identifier`&&s(1).kind===`Operator`&&Qr.has(s(1).text)&&s(2).kind===`Identifier`&&d(`==`,3)){let t=h(),r=f().text,a=h();return m(`==`),{kind:`Operator`,name:r,params:[{name:t,arity:0},{name:a,arity:0}],body:k(),isLocal:e,isRecursive:i.has(r),location:n}}let o=t.kind===`Operator`&&t.text===`-.`,c=t.kind===`Identifier`&&$r.has(s(1).text)&&d(`==`,2);if(o||c){let a=o?t.text:s(1).text;r.index+=o?1:2;let c=o?h():t.text;return m(`==`),{kind:`Operator`,name:a,params:[{name:c,arity:0}],body:k(),isLocal:e,isRecursive:i.has(a),location:n}}let l=h();if(p(`[`)){let t=_(()=>x());return m(`]`),m(`==`),{kind:`Function`,name:l,bounds:t,body:k(),isLocal:e,isRecursive:i.has(l),location:n}}let u=se();return m(`==`),d(`INSTANCE`)?le(l,u,e,n):{kind:`Operator`,name:l,params:u,body:k(),isLocal:e,isRecursive:i.has(l),location:n}},le=(e,t,n,r)=>(m(`INSTANCE`),{kind:`Instance`,name:e,params:t,module:h(),substitutions:p(`WITH`)?v(()=>{let e=f().text;return m(`<-`),{name:e,expression:C()}}):[],isLocal:n,location:r}),A=()=>v(()=>{if(d(`_`)&&s(1).kind===`Operator`){f();let e=f().text;return p(`_`)?{name:e,arity:2}:{name:e,arity:1}}if(s().kind===`Operator`&&d(`_`,1)){let e=f().text;return f(),{name:e===`-`?`-.`:e,arity:1}}let e=h();if(!p(`(`))return{name:e,arity:0};let t=v(()=>m(`_`));return m(`)`),{name:e,arity:t.length}}),ue=(e,t)=>e.column===1?e.kind===`Separator`||e.kind===`ModuleEnd`||e.kind===`End`?!0:e.kind===`Keyword`?ii.has(e.text):e.kind===`Identifier`&&(t.text===`==`||t.text===`(`||t.text===`[`):!1,de=e=>{for(;o().kind!==`End`;){let t=o();if(t.line>e.line&&ue(t,o(1)))return;r.index++}},fe=(e,t)=>{let r=n[e];return r.kind===`End`||r.line>t.line&&ue(r,n[e+1])||r.text===`PROOF`||oi.has(r.text)?!0:r.text===`<`&&n[e+1]?.kind===`Number`&&n[e+2]?.text===`>`},pe=()=>{let e=f();if(s().kind!==`Identifier`||!d(`==`,1)||d(`ASSUME`,2)){de(e);return}let t=h();f();let i={value:r.index};for(;!fe(i.value,e);)i.value++;r.limit=i.value;let o=k(),c=r.index===i.value;if(r.limit=n.length,de(e),c)return{kind:`Operator`,name:t,params:[],body:o,isLocal:!1,isRecursive:!1,location:a(e)}},j=()=>{let e=f(),t=a(e),n=e.text===`AXIOM`;if(s().kind===`Identifier`&&d(`==`,1)){let e=h();return f(),{name:e,expression:k(),isAxiom:n,location:t}}return{name:void 0,expression:k(),isAxiom:n,location:t}},me=e=>{m(`----`),m(`MODULE`);let t=h();m(`----`);let n={name:t,outer:e,modules:[],extends:p(`EXTENDS`)?v(h):[],constants:[],variables:[],definitions:[],instances:[],assumptions:[]};for(;;){let e=s();if(e.kind===`ModuleEnd`||e.kind===`End`)return n;if(e.kind===`Separator`){d(`MODULE`,1)?n.modules.push(he(M(n))):f();continue}switch(e.text){case`CONSTANT`:case`CONSTANTS`:f(),n.constants.push(...A());continue;case`VARIABLE`:case`VARIABLES`:f(),n.variables.push(...v(h));continue;case`ASSUME`:case`ASSUMPTION`:case`AXIOM`:{let e=j();n.assumptions.push(e),e.name!==void 0&&n.definitions.push({kind:`Operator`,name:e.name,params:[],body:e.expression,isLocal:!1,isRecursive:!1,location:e.location});continue}case`RECURSIVE`:f(),A().forEach(e=>i.add(e.name));continue;case`INSTANCE`:n.instances.push(le(void 0,[],!1,a(e)));continue;case`LOCAL`:{if(f(),d(`INSTANCE`)){n.instances.push(le(void 0,[],!0,a(e)));continue}let t=ce(!0);t.kind===`Instance`?n.instances.push(t):n.definitions.push(t);continue}}if(e.kind===`Keyword`&&ai.has(e.text)){let e=pe();e&&n.definitions.push(e);continue}let t=ce(!1);t.kind===`Instance`?n.instances.push(t):n.definitions.push(t)}},M=e=>({extends:[...e.outer?.extends??[],...e.extends],symbols:[...e.outer?.symbols??[],...e.constants,...e.variables.map(e=>({name:e,arity:0})),...e.definitions.map(e=>({name:e.name,arity:e.kind===`Operator`?e.params.length:0}))]}),he=e=>{let t=me(e);return p(`====`),t},ge=me();for(p(`====`);o().kind===`Separator`;)ge.modules.push(he());return ge},ci=e=>{let t={value:e>>>0};return()=>{t.value=t.value+1831565813>>>0;let e=Math.imul(t.value^t.value>>>15,t.value|1),n=e^e+Math.imul(e^e>>>7,e|61);return((n^n>>>14)>>>0)/4294967296}},li=e=>({getLevel:()=>0,getBehavior:()=>[],random:ci(0),generatedStates:0,distinctStates:0,initialStates:0,queueSize:0,diameter:1,registers:/* @__PURE__ */ new Map,namedRegisters:/* @__PURE__ */ new Map,properties:/* @__PURE__ */ new Map,possibleCounts:/* @__PURE__ */ new Map,isStopped:!1,checkDeadlock:e,startedAt:Date.now()}),ui=e=>pe([...e.possibleCounts].map(([e,t])=>[e,t])),di=e=>e.possibleCounts.size===0?e.namedRegisters:new Map([...e.namedRegisters,[`s:_possible`,ui(e)]]),fi=e=>typeof e==`object`&&e.kind===`Operator`,K=(e,t,n)=>{let i=e[t];if(i===void 0||fi(i))throw new r(`${n} expects a value as argument ${t+1}`);return i},pi=(e,t,n)=>{let i=K(e,t,n);if(typeof i!=`number`)throw new r(`${n} expects an integer but received ${I(i)}`);return i},mi=(e,t,n)=>{let i=K(e,t,n);if(typeof i!=`boolean`)throw new r(`${n} expects a boolean but received ${I(i)}`);return i},hi=(e,t,n)=>{let i=K(e,t,n);if(!x(i))throw new r(`${n} expects a set but received ${I(i)}`);return i},gi=(e,t,n)=>{let i=hi(e,t,n);if(!M(i))throw new r(`${n} cannot enumerate the non-enumerable set ${I(i)}`);return N(i)},_i=(e,t,n)=>gi(e,t,n).elements,vi=(e,t,n)=>{let i=K(e,t,n),a=Te(i);if(!a)throw new r(`${n} expects a sequence but received ${I(i)}`);return a},yi=(e,t,n)=>{let i=e[t];if(i===void 0||!fi(i))throw new r(`${n} expects an operator as argument ${t+1}`);return i},bi=(e,t)=>({kind:`Builtin`,name:e,arity:0,evaluate:()=>t,evaluateUnary:void 0,evaluateBinary:void 0}),q=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:t===1?e=>n([e]):void 0,evaluateBinary:t===2?(e,t)=>n([e,t]):void 0}),xi=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:void 0,evaluateBinary:void 0}),J=(e,t,n)=>({kind:`Builtin`,name:e,arity:t,evaluate:n,evaluateUnary:void 0,evaluateBinary:void 0,isStateLevel:!0}),Si=(e,t)=>{if(typeof e!=`number`)throw new r(`${t} expects an integer but received ${I(e)}`);return e},Ci=(e,t)=>({kind:`Builtin`,name:e,arity:2,evaluate:n=>t(K(n,0,e),K(n,1,e)),evaluateUnary:void 0,evaluateBinary:t}),wi=(e,t)=>Ci(e,(n,r)=>te(t(Si(n,e),Si(r,e)))),Ti=(e,t)=>Ci(e,(n,r)=>t(Si(n,e),Si(r,e))),Ei=(e,t,n)=>({...J(e,t,n),isLazy:!0}),Di=(e,t,n)=>{let r=yi(e,t,n);return()=>r.call([])},Oi=(e,t,n)=>new r(`Applying ${e} to the following value,\nwhich is not ${t}:\n${I(n)}`),ki=(e,t,n,i)=>new r(`The ${e} argument of ${t} should be a ${n}, but instead it is:\n${I(i)}`),Ai=e=>S(e)&&(e.kind===`Function`||M(e.domain))?F(e):void 0,ji=(e,t,n)=>{let r=K(e,t,n),i=Ai(r);if(!i)throw Oi(n,`a function with a finite domain`,r);return i},Mi=e=>e.range.every(e=>typeof e==`number`&&e>0),Ni=(e,t,n)=>{if(typeof e!=`number`)throw Oi(t,`a bag`,n);return e},Pi=(e,t)=>{let n=e.domain.findIndex(e=>k(e,t));return n===-1?void 0:e.range[n]},Fi=(e,t)=>{let n=e+t;if(n>2147483647)throw new r(`Overflow when computing ${e}+${t}`);return n},Ii=e=>pe(e.reduce((e,t)=>(t.domain.forEach((n,r)=>{let i=e.find(e=>k(e[0],n));i?i[1]=Fi(Number(i[1]),Number(t.range[r])):e.push([n,t.range[r]])}),e),[])),Li=[bi(`EmptyBag`,O([],[])),q(`IsABag`,1,e=>{let t=Ai(K(e,0,`IsABag`));return t!==void 0&&Mi(t)}),q(`BagCardinality`,1,e=>{let t=K(e,0,`BagCardinality`),n=ji(e,0,`BagCardinality`);return te(n.range.reduce((e,n)=>{let r=Ni(n,`BagCardinality`,t);if(r<=0)throw Oi(`BagCardinality`,`a bag`,t);return Fi(e,r)},0))}),q(`BagIn`,2,e=>{let t=K(e,1,`BagIn`),n=Pi(ji(e,1,`BagIn`),K(e,0,`BagIn`));if(n===void 0)return!1;if(typeof n!=`number`)throw ki(`second`,`BagIn`,`bag`,t);return n>0}),q(`CopiesIn`,2,e=>{let t=K(e,1,`CopiesIn`),n=Pi(ji(e,1,`CopiesIn`),K(e,0,`CopiesIn`));if(n===void 0)return 0;if(typeof n!=`number`)throw ki(`second`,`CopiesIn`,`bag`,t);return n}),q(`\\oplus`,2,e=>{let t=[0,1].map(t=>{let n=ji(e,t,`(+)`);if(!Mi(n))throw ki(t===0?`first`:`second`,`(+)`,`bag`,K(e,t,`(+)`));return n});return Ii(t)}),q(`\\ominus`,2,e=>{let t=ji(e,0,`(-)`),n=ji(e,1,`(-)`);return pe(t.domain.flatMap((e,r)=>{let i=Pi(n,e),a=Number(t.range[r])-(i===void 0?0:Number(i));return a>0?[[e,a]]:[]}))}),q(`BagUnion`,1,e=>{let t=K(e,0,`BagUnion`),n=_i(e,0,`BagUnion`).map(e=>{let n=Ai(e);if(!n)throw new r(`Attempted to apply BagUnion to the following set, whose\nelement is not a bag:\n${I(t)}`);return n});return n.length===1?n[0]:Ii(n)}),q(`\\sqsubseteq`,2,e=>{let t=ji(e,0,`\\sqsubseteq`),n=ji(e,1,`\\sqsubseteq`);return t.domain.every((e,r)=>{let i=Pi(n,e);return Number(t.range[r])-(i===void 0?0:Number(i))<=0})}),xi(`BagOfAll`,2,e=>{let t=yi(e,0,`BagOfAll`),n=K(e,1,`BagOfAll`),r=Ai(n);if(!r)throw ki(`second`,`BagOfAll`,`function with a finite domain`,n);return Ii(r.domain.map((e,n)=>O([t.call([e])],[r.range[n]])))}),q(`SubBag`,1,e=>{throw ji(e,0,`SubBag`),new r(`SubBag is not implemented.`)}),q(`BagToSet`,1,e=>D(ji(e,0,`BagToSet`).domain)),q(`SetToBag`,1,e=>{let t=_i(e,0,`SetToBag`);return O(t,t.map(()=>1))})],Ri=e=>{if(x(e))return N(e).elements.map(Bi);let t=Te(e);return t?t.map(Bi):Object.values(zi(e))},zi=e=>{if(!S(e))throw new r(`Cannot convert ${I(e)} to a JSON object`);let t=F(e);return Object.fromEntries(t.domain.map((e,n)=>[typeof e==`string`?e:I(e),Bi(t.range[n])]))},Bi=e=>typeof e==`boolean`||typeof e==`number`||typeof e==`string`?e:e.kind===`ModelValue`?e.name:x(e)||Te(e)?Ri(e):zi(e),Vi=e=>JSON.stringify(e).replaceAll(`\u2028`,`\\u2028`).replaceAll(`\u2029`,`\\u2029`),Hi=e=>{if(typeof e==`boolean`||typeof e==`string`)return e;if(typeof e==`number`)return te(Math.trunc(e));if(Array.isArray(e))return j(e.map(Hi));if(typeof e==`object`&&e)return me(Object.entries(e).map(([e,t])=>[e,Hi(t)]));throw new r(`Cannot convert value: unsupported JSON value ${String(e)}`)},Ui=(e,t)=>{if(typeof e!=`string`)throw new r(`${t} expects a file name but received ${I(e)}`);return e},Wi=e=>{try{return JSON.parse(e)}catch(t){throw new r(`Cannot parse JSON: ${e}`,t)}},Gi=(e,t)=>{let n=e.readFile?.(t);if(n===void 0)throw new r(`Cannot read the file ${t}`);return n},Ki=e=>[J(`ToJson`,1,e=>Vi(Bi(K(e,0,`ToJson`)))),J(`ToJsonArray`,1,e=>Vi(Ri(K(e,0,`ToJsonArray`)))),J(`ToJsonObject`,1,e=>{let t=K(e,0,`ToJsonObject`);return Vi(Te(t)?Ri(t):zi(t))}),J(`JsonSerialize`,2,t=>(e.writeFile?.(Ui(K(t,0,`JsonSerialize`),`JsonSerialize`),Vi(Bi(K(t,1,`JsonSerialize`)))),!0)),J(`ndJsonSerialize`,2,t=>{let n=K(t,1,`ndJsonSerialize`),i=Te(n);if(!i)throw new r(`The second argument of ndJsonSerialize should be a sequence, but instead it is:\n${I(n)}`);return e.writeFile?.(Ui(K(t,0,`ndJsonSerialize`),`ndJsonSerialize`),i.map(e=>`${Vi(Bi(e))}\n`).join(``)),!0}),J(`JsonDeserialize`,1,t=>Hi(Wi(Gi(e,Ui(K(t,0,`JsonDeserialize`),`JsonDeserialize`))))),J(`ndJsonDeserialize`,1,t=>j(Gi(e,Ui(K(t,0,`ndJsonDeserialize`),`ndJsonDeserialize`)).split(`
-`).map(e=>e.trim()).filter(e=>e!==``).map(e=>Hi(Wi(e)))))],qi=(e,t,n,i)=>new r(`The ${e} argument of ${t} should be a ${n}, but instead it is:\n${i}`),Ji=(e,t,n)=>{if(typeof e!=`number`||e<0)throw qi(t,n,`nonnegative integer`,I(e));return e},Yi=(e,t,n,r)=>{if(!x(e)||!M(e))throw qi(t,n,r,I(e));return N(e).elements},Xi=(e,t)=>e.map(e=>N(e).elements).reduceRight((e,t)=>({remaining:Math.floor(e.remaining/t.length),elements:[t[e.remaining%t.length],...e.elements]}),{remaining:t,elements:[]}).elements,Zi=(e,t)=>{if(typeof e==`object`&&e.kind===`Interval`)return e.low+t;if(typeof e==`object`&&e.kind===`ProductSet`)return j(Xi(e.factors,t));if(typeof e==`object`&&e.kind===`RecordSet`){let n=Xi(e.sets,t);return me(e.names.map((e,t)=>[e,n[t]]))}if(typeof e==`object`&&e.kind===`FunctionSet`){let n=N(e.domain).elements;return O(n,Xi(n.map(()=>e.range),t))}return N(e).elements[t]},Qi=e=>xe(e)?0:typeof e==`object`&&e.kind===`ProductSet`?e.factors.reduce((e,t)=>e*Qi(t),1):typeof e==`object`&&e.kind===`RecordSet`?e.sets.reduce((e,t)=>e*Qi(t),1):typeof e==`object`&&e.kind===`FunctionSet`?Qi(e.range)**Ce(e.domain):Ce(e),$i=(e,t,n)=>{let r=Qi(e),i=/* @__PURE__ */ new Set;for(;i.size<Math.min(t,r);)i.add(Math.floor(n()*r));return[...i].map(t=>Zi(e,t))},ea=(e,t,n,r)=>A(Array.from({length:t},()=>A(e.filter(()=>r()<n)))),ta=(e,t,n)=>{if(t<31&&e>2**t)throw qi(`first`,n,`nonnegative integer that is smaller than the subset's size of 2^${t}`,String(e))},na=(e,t)=>{let n=`RandomSetOfSubsets`,r=Ji(K(e,0,n),`first`,n),i=Ji(K(e,1,n),`second`,n),a=Yi(K(e,2,n),`third`,n,`finite set`);if(ta(r,a.length,n),a.length<i)throw qi(`second`,n,`nonnegative integer in range 0..Cardinality(S)`,String(i));return ea(a,r,a.length===0?0:i/a.length,t.random)},ra=e=>[J(`RandomSubset`,2,t=>{let n=K(t,0,`RandomSubset`);if(typeof n!=`number`)throw qi(`first`,`RandomSubset`,`nonnegative integer`,I(n));if(n<0)throw new r(`Attempted to apply the operator overridden by the Java method\npublic static tlc2.value.impl.Value tlc2.module.Randomization.RandomSubset(tlc2.value.impl.Value,tlc2.value.impl.Value),\nbut it produced the following error:\n${n}`);let i=K(t,1,`RandomSubset`);if(!x(i)||!xe(i)&&!M(i))throw qi(`second`,`RandomSubset`,`a finite set`,I(i));return A($i(i,n,e.random))}),J(`RandomSetOfSubsets`,3,t=>na(t,e)),J(`TestRandomSetOfSubsets`,3,t=>j(Array.from({length:5},()=>N(na(t,e)).elements.length))),J(`RandomSubsetSet`,3,t=>{let n=`RandomSubsetSetProbability`,r=Ji(K(t,0,`RandomSubsetSet`),`first`,n),i=K(t,1,`RandomSubsetSet`);if(typeof i!=`string`)throw qi(`second`,n,`string literal representing a probability`,I(i));let a=Number(i);if(i.trim()===``||Number.isNaN(a)||a<0||a>1)throw qi(`second`,n,`string literal does not represent a parsable probability`,I(i));let o=Yi(K(t,2,`RandomSubsetSet`),`third`,n,`finite set`);return ta(r,o.length,n),ea(o,r,a,e.random)})],ia=me([[`action`,A([])],[`state`,A([])]]),aa=(e,t)=>{if(typeof t==`number`)return e.registers.get(t);if(typeof t==`string`&&t.startsWith(`s:`))return di(e).get(t)},oa=(e,t,n)=>{if(typeof t==`number`&&t>=0)e.registers.set(t,n);else if(typeof t==`string`&&t.startsWith(`s:`))e.namedRegisters.set(t,n);else throw new r(`The first argument of TLCSet should be a nonnegative integer, but instead it is:\n${I(t)}`)},sa=e=>e.every(e=>e!==void 0),ca=(e,t)=>me(t.variables.map((t,n)=>[t,e[n]])),la=(e,t,n)=>{let r=e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0;if(e.kind===`Prime`||e.kind===`Unchanged`)return!0;if(r!==void 0&&!H(e)){if(t.variableIndex.has(r))return!0;let e=Ln(r,t);if(e&&!n.has(e)&&(n.add(e),la(e.body,t,n)))return!0}return In(e).some(e=>la(e,t,n))},ua=(e,t)=>{let n=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new WeakMap,a=e=>{let t=i.get(e)??/* @__PURE__ */ new Map;return i.set(e,t),t};return[q(`AssertEq`,2,t=>{let n=K(t,0,`AssertEq`),r=K(t,1,`AssertEq`),i=k(n,r);return i||(e(`Assertion failed`),e(I(n,!0)),e(I(r,!0))),i}),Ei(`AssertError`,2,e=>{let t=Di(e,0,`AssertError`)();try{Di(e,1,`AssertError`)()}catch(e){if(e instanceof r)return e.message===t;throw e}return!1}),J(`TLCGetOrDefault`,2,e=>{let n=K(e,0,`TLCGetOrDefault`);return aa(t,n)??K(e,1,`TLCGetOrDefault`)}),{...xi(`TLCGetAndSet`,4,e=>{let n=K(e,0,`TLCGetAndSet`),r=aa(t,n)??K(e,3,`TLCGetAndSet`),i=yi(e,1,`TLCGetAndSet`);return oa(t,n,i.call([r,K(e,2,`TLCGetAndSet`)])),r}),isStateLevel:!0},J(`Trace`,0,(e,n)=>{let i=n?.state;if(!i||!sa(i))throw new r(`In evaluating TLCExt!Trace, the state is not completely specified yet`);return j(t.getBehavior(i).map(e=>ca(e,n.environment)))}),bi(`CounterExample`,ia),q(`ToTrace`,1,e=>{let t=K(e,0,`ToTrace`),n=N(De(t,`state`)).elements.map(e=>Te(e)??[]);return j([...n].sort((e,t)=>Number(e[0])-Number(t[0])).map(e=>e[1]))}),q(`TLCModelValue`,1,e=>{let t=K(e,0,`TLCModelValue`);if(typeof t!=`string`)throw new r(`The argument of ModelValue should be a string, but instead it is:\n${I(t)}`);return oe(t)}),Ei(`TLCDefer`,1,e=>(Di(e,0,`TLCDefer`)(),!0)),q(`TLCNoOp`,1,e=>K(e,0,`TLCNoOp`)),Ei(`PickSuccessor`,1,(e,t)=>{if(Di(e,0,`PickSuccessor`)()===!0)return!0;let n=t?.next;if(!n||!sa(n))return!0;throw new r(`PickSuccessor needs interactive input to extend the behavior`)}),Ei(`TLCCache`,2,(e,t)=>{let r=yi(e,0,`TLCCache`),i=Ke(Di(e,1,`TLCCache`)()),o=r.expression;if(!o||!t)return r.call([]);let s=la(o,t.environment,/* @__PURE__ */ new Set)&&t.state?a(t.state):n,c=s.get(o)??/* @__PURE__ */ new Map;s.set(o,c);let l=c.get(i);if(l!==void 0)return l;let u=r.call([]);return c.set(i,u),u}),q(`TLCFP`,1,e=>Le(K(e,0,`TLCFP`))|0),J(`TLCEvalDefinition`,1,(e,t)=>{let n=K(e,0,`TLCEvalDefinition`),i=typeof n==`string`&&t?Ln(n,t.environment):void 0;if(!i||typeof n!=`string`||!t)throw new r(`The argument of TLCEvalDefinition should be a name of a definition reachable from the root module, but instead it is:\n${I(n)}`);if(i.kind===`Operator`&&i.params.length>0)throw new r(`The argument of TLCEvalDefinition should be a zero-arity definition, but instead it is:\n${n}`);return W({kind:`Identifier`,name:n,location:i.location},t)})]},da=(e,t)=>[J(`_Track`,2,e=>{let n=K(e,1,`_Track`),r=t.possibleCounts.get(String(n))??0;return t.possibleCounts.set(String(n),K(e,0,`_Track`)===!0?r+1:r),!0}),J(`_Counts`,0,()=>ui(t)),J(`_CheckName`,1,n=>{let r=String(K(n,0,`_CheckName`));return t.possibleCounts.get(r)?!0:(e(I(ui(t),!0)),!1)}),J(`_PrintCounts`,0,()=>(e(I(ui(t),!0)),!0))],fa=()=>me([[`beginLine`,0],[`beginColumn`,0],[`endLine`,0],[`endColumn`,0],[`module`,`--unknown--`]]),pa=e=>pe([...e].map(([e,t])=>[e,j([t])])),ma=(e,t,n)=>{let i=Math.floor((Date.now()-e.startedAt)/1e3);switch(t){case`level`:return n===void 0?0:e.getLevel(n);case`diameter`:return e.diameter;case`generated`:return e.generatedStates;case`distinct`:return e.distinctStates;case`queue`:return e.queueSize;case`duration`:return i;case`stats`:return me([[`queue`,e.queueSize],[`distinct`,e.distinctStates],[`initial`,e.initialStates],[`generated`,e.generatedStates],[`diameter`,e.diameter],[`duration`,i],[`worker`,0]]);case`config`:return me([[`mode`,`bfs`],[`deadlock`,e.checkDeadlock],[`worker`,1],[`seed`,`0`],[`fingerprint`,`0`],[`install`,``]]);case`revision`:return me([[`count`,0],[`timestamp`,0],[`date`,`1970-01-01T00:00:00.0Z`],[`tag`,`tla-ts`],[`calver`,`0`]]);case`action`:return me([[`name`,`UnnamedAction`],[`location`,fa()]]);case`all`:return pa(e.registers);case`all:named`:return pa(di(e))}if(t.startsWith(`s:`)){let n=di(e).get(t);if(n===void 0)throw new r(`TLCGet(${t}) was undefined.`);return n}if(t.startsWith(`-D`))return e.properties.get(t.slice(2))??t;throw new r(`TLCGet(${t}) was undefined.`)},ha=e=>e.length===0?[[]]:e.flatMap((t,n)=>ha([...e.slice(0,n),...e.slice(n+1)]).map(e=>[t,...e])),ga=(e,t)=>[q(`Print`,2,t=>(e(`${I(K(t,0,`Print`),!0)}  ${I(K(t,1,`Print`),!0)}`),K(t,1,`Print`))),q(`PrintT`,1,t=>(e(I(K(t,0,`PrintT`),!0)),!0)),q(`Assert`,2,e=>{if(K(e,0,`Assert`)!==!0)throw new r(`The first argument of Assert evaluated to FALSE; the second argument was:\n${I(K(e,1,`Assert`))}`);return!0}),q(`JavaTime`,0,()=>Math.floor(Date.now()/1e3)&2147483647),q(`:>`,2,e=>pe([[K(e,0,`:>`),K(e,1,`:>`)]])),q(`@@`,2,e=>{let t=F(K(e,0,`@@`)),n=F(K(e,1,`@@`));return pe([...t.domain.map((e,n)=>[e,t.range[n]]),...n.domain.map((e,t)=>[e,n.range[t]])])}),q(`ToString`,1,e=>I(K(e,0,`ToString`))),q(`TLCEval`,1,e=>K(e,0,`TLCEval`)),q(`Permutations`,1,e=>{let t=_i(e,0,`Permutations`);return A(ha(t).map(e=>pe(t.map((t,n)=>[t,e[n]]))))}),xi(`SortSeq`,2,e=>{let t=yi(e,1,`SortSeq`);return j(vi(e,0,`SortSeq`).reduce((e,n)=>{let r=e.findIndex(e=>t.call([n,e])===!0);return r===-1?[...e,n]:[...e.slice(0,r),n,...e.slice(r)]},[]))}),J(`TLCGet`,1,(e,n)=>{let i=K(e,0,`TLCGet`);if(typeof i==`number`&&i>=0){let e=t.registers.get(i);if(e===void 0)throw new r(`TLCGet(${i}) was undefined.`);return e}if(typeof i!=`string`)throw new r(`The argument of TLCGet should be a nonnegative integer, but instead it is:\n${I(i)}`);return ma(t,i,n?.state)}),J(`TLCSet`,2,e=>{let n=K(e,0,`TLCSet`),i=K(e,1,`TLCSet`);if(typeof n==`number`&&n>=0)return t.registers.set(n,i),!0;if(n===`exit`)return i===!0&&(t.isStopped=!0),!0;if(n===`pause`)return!0;if(typeof n==`string`&&n.startsWith(`s:`))return t.namedRegisters.set(n,i),!0;if(typeof n==`string`&&n.startsWith(`-D`))return t.properties.set(n.slice(2),I(i)),!0;throw new r(`The first argument of TLCSet should be a nonnegative integer, but instead it is:\n${I(n)}`)}),bi(`Any`,{kind:`InfiniteSet`,name:`Any`}),q(`RandomElement`,1,e=>{let n=_i(e,0,`RandomElement`);if(n.length===0)throw new r(`RandomElement of the empty set`);return n[Math.floor(t.random()*n.length)]})],_a=(e,t)=>e.every(e=>P(e,t)),va=A([!1,!0]),ya=D([]),ba=[bi(`TRUE`,!0),bi(`FALSE`,!1),bi(`BOOLEAN`,va),bi(`STRING`,{kind:`InfiniteSet`,name:`STRING`}),Ci(`=`,k),Ci(`#`,(e,t)=>!k(e,t)),q(`~`,1,e=>!mi(e,0,`~`)),q(`<=>`,2,e=>mi(e,0,`<=>`)===mi(e,1,`<=>`)),q(`/\\`,2,e=>mi(e,0,`/\\`)&&mi(e,1,`/\\`)),q(`\\/`,2,e=>mi(e,0,`\\/`)||mi(e,1,`\\/`)),q(`=>`,2,e=>!mi(e,0,`=>`)||mi(e,1,`=>`)),q(`\\in`,2,e=>P(K(e,0,`\\in`),hi(e,1,`\\in`))),q(`\\notin`,2,e=>!P(K(e,0,`\\notin`),hi(e,1,`\\notin`))),q(`\\subseteq`,2,e=>{let t=hi(e,0,`\\subseteq`),n=hi(e,1,`\\subseteq`);return typeof t==`object`&&t.kind===`Subset`&&typeof n==`object`&&n.kind===`Subset`&&M(t.base)?_a(N(t.base).elements,n.base):_a(_i(e,0,`\\subseteq`),n)}),...[`\\cup`,`\\cap`,`\\`].map(e=>q(e,2,t=>{let n=hi(t,0,e),r=hi(t,1,e);if(M(n)&&M(r))return(e===`\\cup`?fe:e===`\\cap`?de:ue)(N(n),N(r));let i=e=>typeof e==`object`&&(e.kind===`Set`||e.kind===`Interval`),a=e===`\\cup`&&!i(n)&&i(r)?{kind:`SetOperation`,operator:e,left:r,right:n}:{kind:`SetOperation`,operator:e,left:n,right:r};return M(a)?N(a):a})),q(`SUBSET`,1,e=>({kind:`Subset`,base:hi(e,0,`SUBSET`)})),q(`UNION`,1,e=>{let t=_i(e,0,`UNION`);return t.forEach(e=>{if(!x(e))throw new r(`UNION expects a set of sets but found ${I(e)}`)}),t.every(e=>typeof e==`object`&&e.kind===`Set`)?t.length>8?A(t.flatMap(e=>N(e).elements)):t.reduce((e,t)=>fe(e,N(t)),ya):t.reduce((e,t)=>({kind:`SetOperation`,operator:`\\cup`,left:e,right:t}))}),q(`DOMAIN`,1,e=>{let t=K(e,0,`DOMAIN`);if(!S(t))throw new r(`DOMAIN expects a function but received ${I(t)}`);return Oe(t)})],xa=[bi(`Nat`,{kind:`InfiniteSet`,name:`Nat`}),wi(`+`,(e,t)=>e+t),wi(`-`,(e,t)=>e-t),wi(`*`,(e,t)=>e*t),wi(`^`,(e,t)=>{if(t<0||e===0&&t===0)throw new r(`${e}^${t} is undefined`);return e**t}),wi(`\\div`,(e,t)=>{if(t===0)throw new r(`Division by zero in ${e} \\div 0`);return Math.floor(e/t)}),wi(`%`,(e,t)=>{if(t<=0)throw new r(`The second argument of % must be positive, but was ${t}`);return(e%t+t)%t}),Ti(`<`,(e,t)=>e<t),Ti(`>`,(e,t)=>e>t),Ti(`<=`,(e,t)=>e<=t),Ti(`>=`,(e,t)=>e>=t),q(`..`,2,e=>({kind:`Interval`,low:pi(e,0,`..`),high:pi(e,1,`..`)}))],Sa=[bi(`Int`,{kind:`InfiniteSet`,name:`Int`}),q(`-.`,1,e=>te(-pi(e,0,`-`)))],Ca=(e,t,n)=>{let r=K(e,t,n);return typeof r==`string`?r:vi(e,t,n)},wa=[q(`Seq`,1,e=>({kind:`SequenceSet`,base:hi(e,0,`Seq`)})),q(`Len`,1,e=>Ca(e,0,`Len`).length),q(`\\o`,2,e=>{let t=Ca(e,0,`\\o`),n=Ca(e,1,`\\o`);if(typeof t==`string`&&typeof n==`string`)return t+n;if(typeof t==`string`||typeof n==`string`)throw new r(`\\o cannot concatenate a string with a sequence`);return j([...t,...n])}),q(`Append`,2,e=>j([...vi(e,0,`Append`),K(e,1,`Append`)])),q(`Head`,1,e=>{let t=vi(e,0,`Head`);if(t.length===0)throw new r(`Attempted to apply Head to the empty sequence`);return t[0]}),q(`Tail`,1,e=>{let t=Ca(e,0,`Tail`);if(t.length===0)throw new r(`Attempted to apply Tail to the empty sequence`);return typeof t==`string`?t.slice(1):j(t.slice(1))}),q(`SubSeq`,3,e=>{let t=Ca(e,0,`SubSeq`),n=pi(e,1,`SubSeq`),i=pi(e,2,`SubSeq`);if(n>i)return typeof t==`string`?``:j([]);if(n<1||i>t.length)throw new r(`SubSeq bounds ${n}..${i} are outside 1..${t.length}`);return typeof t==`string`?t.slice(n-1,i):j(t.slice(n-1,i))}),xi(`SelectSeq`,2,e=>{let t=yi(e,1,`SelectSeq`);return j(vi(e,0,`SelectSeq`).filter(e=>{let n=t.call([e]);if(typeof n!=`boolean`)throw new r(`The test of SelectSeq must return a boolean`);return n}))})],Ta=[q(`IsFiniteSet`,1,e=>M(hi(e,0,`IsFiniteSet`))),q(`Cardinality`,1,e=>{let t=hi(e,0,`Cardinality`);if(xe(t))return 0;if(!M(t))throw new r(`Cardinality of the infinite set ${I(t)}`);return Ce(t)})],Ea=(e,t,n,r)=>{switch(e){case`Naturals`:return{extends:[],operators:xa};case`Integers`:return{extends:[`Naturals`],operators:Sa};case`Sequences`:return{extends:[],operators:wa};case`FiniteSets`:return{extends:[],operators:Ta};case`TLC`:return{extends:[],operators:ga(t,n)};case`Randomization`:return{extends:[],operators:ra(n)};case`_Possible`:return{extends:[],operators:da(t,n)};case`Json`:return{extends:[],operators:Ki(r)};case`Bags`:return{extends:[],operators:Li};case`TLCExt`:return{extends:[],operators:ua(t,n)};default:return}},Da={kind:`Local`},Oa=`$subexpression`,ka=e=>`line ${e.line}, column ${e.column}`,Y=(e,n)=>new t(`${e} at ${ka(n)}`),Aa=e=>e.kind===`Name`?[e.name]:e.names,ja=e=>e.flatMap(e=>Aa(e.pattern)),Ma=e=>e.filter((t,n)=>n===0||e[n-1].set!==t.set).map(e=>e.set),Na=(e,t)=>typeof e==`number`?e>=1&&e<=t?e-1:-1:e===`<<`?t>0?0:-1:t===2?1:-1,Pa=e=>{switch(e.kind){case`Apply`:return e.args;case`And`:case`Or`:return e.operands;case`If`:return[e.condition,e.consequent,e.alternative];case`Tuple`:case`SetEnumeration`:return e.elements;case`Record`:case`RecordSet`:return e.fields.map(e=>e.value);case`FunctionApplication`:return[e.function,e.args.length===1?e.args[0]:{kind:`Tuple`,elements:e.args,location:e.location}];case`FieldAccess`:return[e.record,{kind:`String`,value:e.field,location:e.location}];case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return[e.expression];case`BoxAction`:case`AngleAction`:return[e.action,e.subscript];case`WeakFairness`:case`StrongFairness`:return[e.subscript,e.action];case`FunctionSet`:return[e.domain,e.range];case`Product`:return e.factors;case`Except`:return[e.function];default:return}},Fa=e=>{switch(e.kind){case`Forall`:case`Exists`:case`FunctionConstruction`:return{names:ja(e.bounds),body:e.body,sets:Ma(e.bounds)};case`SetMap`:return{names:ja(e.bounds),body:e.expression,sets:Ma(e.bounds)};case`SetFilter`:return{names:Aa(e.bound.pattern),body:e.predicate,sets:[e.bound.set]};case`Choose`:return{names:Aa(e.pattern),body:e.body,sets:e.set?[e.set]:[]};case`UnboundedQuantifier`:case`Lambda`:return{names:e.kind===`Lambda`?e.params:e.names,body:e.body,sets:[]};default:return}},Ia=(e,t,n)=>{if(e.kind===`Label`)return e.name===t?{label:e,lets:n}:void 0;if(e.kind===`Let`)return Ia(e.body,t,[...n,e.definitions]);if(e.kind!==`Lambda`)for(let r of In(e)){let e=Ia(r,t,n);if(e)return e}},La=(e,t,n)=>e.args.length===0&&n.length>0?n.splice(0,t):e.args,Ra=(e,t,n)=>t.reduceRight((e,t)=>({kind:`Let`,definitions:t,body:e,location:n}),e),za=(e,t)=>{let n=e.location,r=Ra(t,e.lets,n);if(e.params.length===0)return r;if(e.args.length===0){if(e.params.some(e=>e.arity>0))throw Y(`Selected an operator with operator parameters as an argument`,n);return{kind:`Lambda`,params:e.params.map(e=>e.name),body:r,location:n}}if(e.args.length!==e.params.length)throw Y(`The subexpression requires ${e.params.length} arguments but received ${e.args.length}`,n);return{kind:`Let`,definitions:[{kind:`Operator`,name:Oa,params:e.params,body:r,isLocal:!0,isRecursive:!1,location:n}],body:{kind:`Apply`,operator:Oa,args:e.args,location:n,resolution:Da},location:n}},Ba=(e,t)=>{let n=t.location,r=e.kind===`Operator`?e.params.map((e,n)=>({name:`${e.name}$${t.params.length+n}`,arity:e.arity})):[],i=r.map(e=>({kind:`Identifier`,name:e.name,location:n,resolution:Da})),a=i.length===0?{kind:`Identifier`,name:e.name,location:n,resolution:Da}:{kind:`Apply`,operator:e.name,args:i,location:n,resolution:Da};return za({...t,params:[...t.params,...r]},a)},Va=(e,t,n,r)=>{let i={params:[],args:[],lets:[],location:n},a={index:0,current:void 0},o=i=>{let o=[],s=[];for(;a.index<e.length;){let c=e[a.index];if(c.kind!==`Name`)throw Y(`Expected an operator name`,n);o.push(c.name),s.push(...c.args);let l=o.join(`!`),u=i?i.find(e=>e.name===l):t(l);if(u){let e=u.kind===`Operator`?u.params.length:0;return{definition:u,args:s.length===0&&r.length>0?r.splice(0,e):s}}a.index++}throw Y(`Unknown operator ${o.join(`!`)}`,n)},s=t=>{let r=o(t),s=r.definition,c=s.kind===`Operator`?s.params.length:0,l=a.index===e.length-1;if(r.args.length!==c&&r.args.length!==0)throw Y(`The operator ${s.name} requires ${c} arguments`,n);if(l)return{definition:s,args:r.args};if(s.kind!==`Operator`)throw Y(`Cannot select a subexpression of ${s.name}`,n);i.params.push(...s.params),i.args.push(...r.args),a.current=s.body,a.index++},c=()=>{for(;a.index<e.length&&e[a.index].kind===`Name`;){let t=e[a.index],o=a.current&&Ia(a.current,t.name,[]);if(!o)throw Y(`Cannot find label ${t.name}`,n);i.lets.push(...o.lets),i.params.push(...o.label.params.map(e=>({name:e,arity:0}))),i.args.push(...La(t,o.label.params.length,r)),a.current=o.label.body,a.index++}},l=t=>{let o=a.current;if(!o)throw Y(`Subexpression selection failed`,n);if(t.kind===`Colon`)return;if(o.kind===`Label`){a.current=o.body,l(t);return}if(o.kind===`Let`){if(t.kind!==`Operand`||Na(t.operand,1)!==0)throw Y(`A LET/IN expression has only one operand`,n);i.lets.push(o.definitions),a.current=o.body;return}let s=Fa(o);if(s&&(t.kind===`Bound`||t.kind===`At`)){i.params.push(...s.names.map(e=>({name:e,arity:0}))),t.kind===`Bound`&&i.args.push(...La(t,s.names.length,r)),a.current=s.body;return}if(o.kind===`Case`&&t.kind===`Operand`){let r=[...o.arms,...o.other?[{condition:void 0,body:o.other}]:[]],i=r[Na(t.operand,r.length)],s=e[a.index+1];if(!i||s?.kind!==`Operand`)throw Y(`A subexpression of CASE must have the form !i!j`,n);a.index++;let c=Na(s.operand,2),l=c===0?i.condition:c===1?i.body:void 0;if(!l)throw Y(`Nonexistent CASE operand`,n);a.current=l;return}if(t.kind!==`Operand`)throw Y(`Unexpected subexpression selector`,n);let c=s?s.sets:Pa(o),u=c?.[Na(t.operand,c.length)];if(!u)throw Y(`Nonexistent operand specified by the selector`,n);a.current=u},u=s(void 0);if(u)return Ba(u.definition,{...i,args:u.args});for(c();a.index<e.length;){let t=e[a.index];if(t.kind===`Name`){for(;a.current?.kind===`Label`;)a.current=a.current.body;if(a.current?.kind!==`Let`)throw Y(`A name selector here must be from a LET clause`,n);i.lets.push(a.current.definitions);let e=a.current.definitions,t=s(e);if(t)return Ba(t.definition,{...i,args:[...i.args,...t.args]});c()}else l(t),a.index++}if(!a.current)throw Y(`Subexpression selection failed`,n);return za(i,a.current)},Ha=(e,t)=>{if(!e.includes(`!`)||t(e))return;let n=e.split(`!`),r=n.findIndex((e,r)=>t(n.slice(0,r+1).join(`!`)));if(r!==-1)return[{kind:`Name`,name:n.slice(0,r+1).join(`!`),args:[]},...n.slice(r+1).map(e=>({kind:`Name`,name:e,args:[]}))]},Ua=e=>e.kind===`Subexpression`||e.kind===`Identifier`&&e.name.includes(`!`)||e.kind===`Apply`&&e.operator.includes(`!`)||In(e).some(Ua),Wa=(e,t)=>{if(!Ua(e))return e;if(e.kind===`Let`){let n=n=>e.definitions.find(e=>e.name===n)??t(n);return Nt(e,e=>Wa(e,n))}let n=Nt(e,e=>Wa(e,t));if(n.kind===`Subexpression`)return Va(n.selectors,t,n.location,[]);let r=n.kind===`Identifier`?n.name:n.kind===`Apply`?n.operator:``,i=Ha(r,t);if(!i)return n;let a=n.kind===`Apply`?[...n.args]:[],o=Va(i,t,n.location,a);if(a.length>0)throw Y(`Too many arguments for ${r}`,n.location);return o},Ga=e=>{let t=new Map(e.map(e=>[e.name,e]));return e=>t.get(e)},Ka=(e,t)=>{let n=Ga(t.definitions);return{...e,substitutions:e.substitutions.map(e=>({name:e.name,expression:Wa(e.expression,n)}))}},qa=(e,t)=>{let n=Ga([...t,...e.definitions]);return e.definitions.some(e=>Ua(e.body))||e.assumptions.some(e=>Ua(e.expression))?{...e,definitions:e.definitions.map(e=>Mt(e,e=>Wa(e,n))),assumptions:e.assumptions.map(e=>({...e,expression:Wa(e.expression,n)}))}:e},Ja=e=>{switch(e.kind){case`Number`:return te(e.value);case`String`:case`Boolean`:return e.value;case`ModelValue`:return oe(e.name);case`Set`:return A(e.elements.map(Ja))}},Ya={kind:`Local`},Xa=(e,t)=>({kind:`Operator`,name:t,params:[],body:{kind:`Let`,definitions:[e],body:{kind:`Identifier`,name:e.name,location:e.location,resolution:Ya},location:e.location},isLocal:!0,isRecursive:!1,location:e.location}),Za=(e,t)=>({kind:`Builtin`,name:e,arity:t[0][0].length,evaluate:n=>{let i=t.find(e=>e[0].every((e,t)=>{let r=n[t];return(typeof r!=`object`||r.kind!==`Operator`)&&k(e,r)}));if(i)return i[1];throw new r(`Attempted to apply operator:\n${e}\nto arguments (${n.map(e=>typeof e==`object`&&e.kind===`Operator`?e.name:I(e)).join(`, `)}), which is undefined.`)},evaluateUnary:void 0,evaluateBinary:void 0}),Qa=(e,t)=>e.kind===`Identifier`&&t.has(e.name)||e.kind===`Apply`&&t.has(e.operator)||In(e).some(e=>Qa(e,t)),$a=e=>e.kind===`Operator`?e.params.length:0,eo=(e,t)=>{let n=new Map(e.map((e,t)=>[e,t]));return new Set(t).forEach(e=>n.set(Pt(e),n.get(e)??n.size)),n},to=(e,r,i)=>{let a=/* @__PURE__ */ new Map,o=/* @__PURE__ */ new Map,s=new Map(ba.map(e=>[e.name,e])),c=/* @__PURE__ */ new Map,l=li(r.checkDeadlock),u=/* @__PURE__ */ new Map,d={value:0},f=e=>{let t=c.get(e);if(t)return t;let n=Ea(e,i.print,l,i.files);if(!n)return;let r=/* @__PURE__ */ new Map;return n.extends.forEach(e=>f(e)?.forEach((e,t)=>r.set(t,e))),n.operators.forEach(e=>{s.set(e.name,e),r.set(e.name,{key:e.name,arity:e.arity})}),c.set(e,r),r},p=/* @__PURE__ */ new Map,m=/* @__PURE__ */ new Map,h=e=>(e.modules.forEach(t=>{p.has(t.name)||(m.set(t.name,e),p.set(t.name,h(t)))}),e);h(e);let g=e=>{let n=p.get(e);if(n)return n;let r=i.loadModule?.(e)??Zr.get(e);if(r===void 0)throw new t(`Cannot find source file for module ${e}`);return h(si(r))},_=(t,n)=>t===e?n:`${n}@${t.name}`,v=(e,t)=>{let n=m.get(e.name);return!n||!e.outer?t:n.definitions.some(e=>e.name===t)?_(n,t):n.constants.some(e=>e.name===t)||n.variables.includes(t)?t:v(n,t)},y=e=>u.get(e)??ne(g(e)),ee=(e,t,n,r)=>{let i=f(e.module);if(i)return e.name===void 0?i:new Map([...i].map(([t,n])=>[`${e.name}!${t}`,n]));let s=y(e.module),c=[...s.constants,...s.variables.map(e=>({name:e,arity:0}))],l=`#${d.value++}`,u=new Map(e.params.map(e=>[e.name,`${e.name}${l}`])),p=Tt(Ka(e,t),c,t,n),m=Kt({params:e.params.map(e=>({...e,name:`${e.name}${l}`})),substitutions:new Map([...p].map(([e,t])=>[e,At(t,u)])),variables:new Set(s.variables),getDefinition:e=>a.get(e),isParameterized:e=>o.get(e)===!0,addDefinition:(e,n)=>{let i=`${e}@${t.name}#${d.value++}`;return a.set(i,n(i)),o.set(i,!r),i}}),h=new Set(c.map(e=>e.name)),g=/* @__PURE__ */ new Map;return s.exported.forEach((t,n)=>{h.has(n)||(e.name===void 0?g.set(n,{key:m.getKey(t.key),arity:t.arity}):g.set(`${e.name}!${n}`,{key:m.getQualifiedKey(t.key),arity:t.arity+e.params.length}))}),g},b=(e,t)=>e.map(e=>({kind:`Identifier`,name:e.name,location:t,resolution:Ya})),x=(e,t,n,r,i)=>({kind:`Operator`,name:e,params:n,body:r.length===0?{kind:`Identifier`,name:t,location:i}:{kind:`Apply`,operator:t,args:b(r,i),location:i},isLocal:!0,isRecursive:!1,location:i}),S=e=>Array.from({length:e},(e,t)=>({name:`argument${t}`,arity:0})),C=(e,t,n)=>{if(t.arity===0)return{params:[],body:e};if(e.kind===`Lambda`)return{params:e.params.map(e=>({name:e,arity:0})),body:e.body};let r=S(t.arity);return{params:r,body:{kind:`Apply`,operator:e.kind===`Identifier`?e.name:e.kind===`OperatorReference`?e.operator:t.name,args:b(r,n),location:n}}},w=e=>{let t=e.location,n=e.params,r=f(e.module);if(r)return e.name===void 0?[]:[...r].map(([r,i])=>{let a=S(i.arity);return x(`${e.name}!${r}`,i.key,[...n,...a],a,t)});let i=y(e.module),s=`#${d.value++}`,c=new Map(e.substitutions.map(e=>[e.name,e.expression])),l=[...i.constants,...i.variables.map(e=>({name:e,arity:0}))],u=e=>c.get(e.name)??{kind:`Identifier`,name:e.name,location:t},p=new Set(n.map(e=>e.name)),m=e=>Qa(u(e),p),h=l.map(e=>{let r=C(u(e),e,t);return{kind:`Operator`,name:`${e.name}${s}`,params:[...m(e)?n:[],...r.params],body:r.body,isLocal:!0,isRecursive:!1,location:t}}),g=[],_=Kt({params:n,substitutions:new Map(l.map(e=>[e.name,m(e)?{kind:`Apply`,operator:`${e.name}${s}`,args:b(n,t),location:t,resolution:Ya}:{kind:`Identifier`,name:`${e.name}${s}`,location:t,resolution:Ya}])),variables:new Set(i.variables),getDefinition:e=>a.get(e),isParameterized:e=>o.get(e)===!0,addDefinition:(t,n)=>{let r=`${t}@${e.module}${s}.${g.length}`,i=n(r);return g.push(i.kind===`Operator`?{...i,name:r}:Xa(i,r)),r}}),v=new Set(l.map(e=>e.name)),ee=[...i.exported].filter(([e])=>!v.has(e)).map(([r,i])=>{let a=_.getKey(i.key),o=S(i.arity),s=[...n,...o];return x(e.name===void 0?r:`${e.name}!${r}`,a,s,a===i.key?o:s,t)});return[...h,...g,...ee]},te=e=>[...e].flatMap(([e,t])=>{let n=a.get(t.key);return n?[{...n,name:e}]:[]}),ne=e=>{let t=new Map(ba.map(e=>[e.name,{key:e.name,arity:e.arity}])),n=/* @__PURE__ */ new Map,r=[...e.constants],i=[...e.variables],s=(e,r)=>e.forEach((e,i)=>{t.set(i,e),r&&n.set(i,e)});e.outer?.extends.forEach(e=>s(f(e)??y(e).exported,!1)),e.outer?.symbols.forEach(n=>t.set(n.name,{key:v(e,n.name),arity:n.arity})),e.extends.forEach(e=>{let t=f(e);if(t){s(t,!0);return}let n=y(e);r.push(...n.constants.filter(e=>r.every(t=>t.name!==e.name))),i.push(...n.variables.filter(e=>!i.includes(e))),s(n.exported,!0)}),e.constants.forEach(e=>n.set(e.name,{key:e.name,arity:e.arity})),e.variables.forEach(e=>n.set(e,{key:e,arity:0}));let c=r.length===0&&i.length===0,l=t=>_(e,t.name),d=e=>({imported:t,definitions:new Map(e.definitions.map(e=>[e.name,e])),getKey:l});e.instances.forEach(t=>s(ee(t,e,d(e),c),!t.isLocal));let p=qa(Yt(e,w),te(t));Et(p,d(p)),p.definitions.forEach(e=>{let r=l(e);a.set(r,e),o.set(r,!c);let i={key:r,arity:$a(e)};t.set(e.name,i),e.isLocal||n.set(e.name,i)});let m={module:p,constants:r,variables:i,visible:t,exported:n};return u.set(e.name,m),m},re=ne(e),ie=e=>re.visible.get(e)?.key??e;re.visible.forEach((e,t)=>{let n=a.get(e.key);n&&e.key!==t&&a.set(t,n)});let ae=[],T=(e,t)=>{t.has(e.name)||(t.add(e.name),e.extends.forEach(e=>{let n=u.get(e);n&&T(n.module,t)}),ae.push(...e.assumptions))};T(re.module,/* @__PURE__ */ new Set);let E=re.constants.map(e=>e.name),oe=re.variables,D=t=>t.module===void 0?[t.name,ie(t.name)]:t.module===e.name||E.includes(t.name)?[]:[u.get(t.module)?.visible.get(t.name)?.key??t.name],O=/* @__PURE__ */ new Map;r.constants.filter(e=>e.args===void 0).forEach(e=>{let t=Ja(e.value);D(e).forEach(e=>O.set(e,t))});let k=/* @__PURE__ */ new Map;r.constants.forEach(e=>{if(e.args===void 0)return;let t=k.get(e.name)??[];if(t.length>0&&t[0][0].length!==e.args.length)throw new n(`The operator ${e.name} is assigned values with inconsistent arities`);t.push([e.args.map(Ja),Ja(e.value)]),k.set(e.name,t)}),k.forEach((e,t)=>{s.set(t,Za(t,e)),O.delete(t)});let se=new Map(r.substitutions.flatMap(e=>D(e).map(t=>[t,ie(e.target)])));E.forEach(e=>{if(!O.has(e)&&!se.has(e)&&!k.has(e))throw new n(`The constant ${e} is not assigned a value by the configuration`)});let ce={runtime:l,definitions:a,builtins:s,constants:O,substitutions:se,variables:oe,variableIndex:eo(oe,[...u.values()].flatMap(e=>e.module.variables)),definitionValues:/* @__PURE__ */ new Map,constantLevels:/* @__PURE__ */ new Map,evaluators:/* @__PURE__ */ new WeakMap};return se.forEach((e,t)=>{let r=a.get(e);if(E.includes(t)&&r&&!zn(r,ce))throw new n(`The configuration file substitutes constant ${t} with non-constant ${e}`)}),{environment:ce,assumptions:ae}},no={kind:`Boolean`,value:!0},ro={kind:`Boolean`,value:!1},io=e=>e?no:ro,ao=e=>e.kind===`State`||e.kind===`Enabled`||e.kind===`Action`,oo=e=>e.kind===`State`||e.kind===`Enabled`||e.kind===`Boolean`,X=(e,t)=>({kind:e,body:t}),so=(e,t,n)=>({kind:e,operands:[t,n]}),Z=(e,t)=>({kind:e,operands:t.flatMap(t=>t.kind===e?Z(e,t.operands).operands:[t])}),co=e=>{switch(e.kind){case`Boolean`:return 0;case`State`:case`Enabled`:return 1;case`Action`:case`Next`:return 2;case`Not`:return co(e.body);case`Always`:case`Eventually`:return 3;case`And`:case`Or`:return e.operands.reduce((e,t)=>Math.max(e,co(t)),0)}},lo=e=>{switch(e.kind){case`Action`:return!0;case`Boolean`:case`State`:case`Enabled`:return!1;case`Not`:case`Always`:case`Eventually`:case`Next`:return lo(e.body);case`And`:case`Or`:return e.operands.some(lo)}},uo=(e,t)=>e.kind===t.kind?e.kind===`Boolean`&&t.kind===`Boolean`?e.value===t.value:ao(e)?e===t:`body`in e&&`body`in t?uo(e.body,t.body):`operands`in e&&`operands`in t&&e.operands.length===t.operands.length&&e.operands.every((e,n)=>uo(e,t.operands[n])):!1,Q=(e,t)=>e.some(e=>uo(e,t)),fo=e=>e===`And`?`Or`:`And`,po=(e,t)=>{switch(e.kind){case`Boolean`:return t?io(!e.value):e;case`State`:case`Enabled`:case`Action`:case`Next`:return t?X(`Not`,e):e;case`Not`:return po(e.body,!t);case`And`:case`Or`:return Z(t?fo(e.kind):e.kind,e.operands.map(e=>po(e,t)));case`Always`:case`Eventually`:{let n=t===(e.kind===`Always`)?`Eventually`:`Always`;return X(n,po(e.body,t))}}},mo=e=>{switch(e.kind){case`Boolean`:return io(!e.value);case`Not`:return e.body;case`And`:case`Or`:return Z(fo(e.kind),e.operands.map(mo));case`Always`:return X(`Eventually`,mo(e.body));case`Eventually`:return X(`Always`,mo(e.body));default:return X(`Not`,e)}},ho=e=>{switch(e.kind){case`And`:case`Or`:{let t=e.kind===`Or`,n=[];for(let r of e.operands){let e=ho(r);if(e.kind!==`Boolean`)n.push(e);else if(e.value===t)return io(t)}return n.length===0?io(!t):n.length===1?n[0]:Z(e.kind,n)}case`Not`:{let t=ho(e.body);return t.kind===`Boolean`?io(!t.value):X(`Not`,t)}case`Always`:case`Eventually`:{let t=ho(e.body);return X(e.kind,t.kind===e.kind?t.body:t)}default:return e}},go=e=>e.kind===`Always`&&e.body.kind===`Eventually`?e.body.body:void 0,_o=e=>{switch(e.kind){case`And`:{let t=[],n={value:1};for(let i of e.operands){let e=_o(i);if(e.kind===`Or`){if(n.value*=e.operands.length,n.value>2147483647)throw new r(`TLC cannot handle the temporal formula because it exceeds the maximum supported size in disjunctive normal form`);t.push(e)}else e.kind===`And`?t.push(...e.operands):t.push(e)}if(n.value===1)return{kind:`And`,operands:t};let i=Array.from({length:n.value},()=>[]),a={groups:1,repeat:n.value};for(let e of t){if(e.kind!==`Or`){i.forEach(t=>t.push(e));continue}a.repeat/=e.operands.length;let t={value:0};for(let n=0;n<a.groups;n++)for(let n of e.operands)for(let e=0;e<a.repeat;e++)i[t.value++].push(n);a.groups*=e.operands.length}return{kind:`Or`,operands:i.map(e=>Z(`And`,e))}}case`Or`:{let t=[],n=[];for(let r of e.operands){let e=_o(r);for(let r of e.kind===`Or`?e.operands:[e]){let e=go(r);e?t.push(e):n.push(r)}}if(t.length>0){let e=t.length===1?t[0]:Z(`Or`,t);n.push(X(`Always`,X(`Eventually`,e)))}return Z(`Or`,n)}case`Not`:return ao(e.body)?e:_o(mo(e.body));default:return e}},vo=e=>{switch(e.kind){case`And`:case`Or`:return e.operands.length===1?vo(e.operands[0]):Z(e.kind,e.operands.map(vo));case`Not`:return e.body.kind===`Not`?vo(e.body.body):X(`Not`,vo(e.body));case`Always`:case`Eventually`:case`Next`:return X(e.kind,vo(e.body));default:return e}},yo=e=>{switch(e.kind){case`And`:case`Or`:{if(e.operands.length===1)return yo(e.operands[0]);let t=Math.floor(e.operands.length/2);return so(e.kind,yo(Z(e.kind,e.operands.slice(0,t))),yo(Z(e.kind,e.operands.slice(t))))}case`Not`:case`Always`:case`Eventually`:case`Next`:return X(e.kind,yo(e.body));default:return e}},bo=(e,t)=>{e.kind===`Eventually`&&!Q(t,e)&&t.push(e),`body`in e&&bo(e.body,t),`operands`in e&&e.operands.forEach(e=>bo(e,t))},xo=e=>{let t=e.filter(oo),n=e.flatMap(e=>e.kind===`Not`&&oo(e.body)?[e.body]:[]);return!t.some(e=>Q(n,e))},So=e=>{let t=[...e],n=[];for(;t.length>0;){let e=t.pop();if(!e)break;switch(e.kind){case`Not`:t.push(e.body);break;case`Next`:n.push(e),t.push(e.body);break;case`Always`:case`Eventually`:n.push(e,X(`Next`,e)),t.push(e.body);break;case`And`:case`Or`:t.push(...e.operands),n.push(e);break;case`Action`:throw new r(`TLC encountered actions while constructing the tableau`);default:n.push(e)}}return n},Co=(e,t,n)=>{if(e.kind===t&&`body`in e)return[e.body,X(`Next`,e)];if(e.kind===n&&`operands`in e)return[e.operands[0],e.operands[1]]},wo=(e,t,n)=>e.flatMap(e=>{let r=Co(e,t,n);return r?[{whole:e,first:r[0],second:r[1]}]:[]}),To=(e,t)=>e.every(e=>Q(t,e))&&t.every(t=>Q(e,t)),Eo=(e,t)=>[...e.filter(e=>!t.some(t=>To(e,t))),...t],Do=e=>{let t=So(e),n=wo(t,`Always`,`And`),r=wo(t,`Eventually`,`Or`),i=e=>{for(let t of e){let n=Co(t,`Eventually`,`Or`);if(!n)continue;let[r,i]=n;if(!(Q(e,r)||Q(e,i)))return Eo(a([...e,r]),a([...e,i]))}let t=r.find(t=>(Q(e,t.first)||Q(e,t.second))&&!Q(e,t.whole));return t?a([...e,t.whole]):[e]},a=e=>{if(!xo(e))return[];let t=[...e];for(let e=0;e<t.length;e++){let n=Co(t[e],`Always`,`And`);if(!n)continue;let[r,i]=n;Q(t,r)||t.push(r),Q(t,i)||t.push(i)}let r={isChanged:!0};for(;r.isChanged;){r.isChanged=!1;for(let e of n)Q(t,e.first)&&Q(t,e.second)&&!Q(t,e.whole)&&(t.push(e.whole),r.isChanged=!0)}return t.length>e.length&&!xo(t)?[]:i(t)};return a(e)},Oo=e=>({particle:e,successors:[],statePredicates:e.filter(e=>co(e)<=1)}),ko=e=>{let t=Do([e]).map(Oo),n=t.length;for(let e=0;e<t.length;e++){let n=t[e].particle.flatMap(e=>e.kind===`Next`?[e.body]:[]);for(let r of Do(n)){let n=t.findIndex(e=>To(e.particle,r));n===-1&&t.push(Oo(r)),t[e].successors.push(n===-1?t.length-1:n)}}return{nodes:t,initialCount:n}},Ao=(e,t)=>!Q(e,t)||Q(e,t.body),jo=(e,t)=>{if(e.kind===`Eventually`&&e.body.kind===`Always`&&co(e.body.body)<3){t.eventuallyAlways.push(e.body.body);return}let n=go(e);if(n){let e=co(n);if(e<=1){t.infinitelyOftenStates.push(n);return}if(e===2){t.infinitelyOftenActions.push(n);return}}if(lo(e))throw new r(`TLC cannot handle the temporal formula: actions may only appear as []<>A or <>[]A`);t.formulas.push(e)},Mo=(e,t)=>{let n=e.findIndex(e=>uo(e,t));return n===-1?(e.push(t),e.length-1):n},No=e=>{let t=_o(ho(po(e,!1)));if(t.kind===`Boolean`&&!t.value)return[];let n=[];for(let e of t.kind===`Or`?t.operands:[t]){let t=vo(e),r={eventuallyAlways:[],infinitelyOftenStates:[],infinitelyOftenActions:[],formulas:[]};for(let e of t.kind===`And`?t.operands:[t])jo(e,r);let i=r.formulas,a=i.length===0?void 0:i.length===1?i[0]:Z(`And`,i),o=n.find(e=>e.formula===void 0||a===void 0?e.formula===a:uo(e.formula,a));o?o.classifications.push(r):n.push({formula:a,classifications:[r]})}return n.map(e=>{let t=e.formula&&yo(e.formula),n=[];t&&bo(t,n);let r=[],i=[],a=e.classifications.map(e=>({infinitelyOftenActions:e.infinitelyOftenActions.map(e=>Mo(i,e)),infinitelyOftenStates:e.infinitelyOftenStates.map(e=>Mo(r,e)),eventuallyAlways:e.eventuallyAlways.map(e=>Mo(i,e))}));return{tableau:t&&ko(t),promises:n,stateChecks:r,actionChecks:i,models:a}})},Po=/* @__PURE__ */ new Set([`~>`,`-+->`]),Fo=/* @__PURE__ */ new WeakMap,Io=/* @__PURE__ */ new WeakSet,Lo=(e,t)=>({environment:e,scope:t,state:void 0,next:void 0}),Ro=e=>`line ${e.location.line}, column ${e.location.column}`,zo=e=>new r(`TLC cannot handle the temporal formula at ${Ro(e)}`),$=(e,t,n,r=/* @__PURE__ */ new Set)=>{let i=e=>{let r=Nn(t,e);if(!r)return;if(r.kind===`Value`)return 0;if(r.kind===`Thunk`)return $(r.expression,r.scope,n);let i=r.operator;return i.kind===`Closure`?$(i.body,i.scope,n):0},a=e=>{if(n.variableIndex.has(e))return 1;if(n.constants.has(e))return 0;let t=Ln(e,n);if(t)return Bo(t,n);let r=n.builtins.get(n.substitutions.get(e)??e);return r?+!!r.isStateLevel:void 0},o=(e,t)=>r.has(e)?0:H(t)?i(e)??a(e)??0:a(e)??i(e)??0,s=e=>{let i={value:0};return Nt(e,(e,a)=>(i.value=Math.max(i.value,$(e,t,n,a.length===0?r:/* @__PURE__ */ new Set([...r,...a]))),e)),i.value};switch(e.kind){case`Prime`:case`Unchanged`:case`BoxAction`:case`AngleAction`:return 2;case`Enabled`:return 1;case`Always`:case`Eventually`:case`WeakFairness`:case`StrongFairness`:return 3;case`UnboundedQuantifier`:return e.isTemporal?3:s(e);case`Identifier`:return o(e.name,e);case`OperatorReference`:return o(e.operator,e);case`Apply`:return Po.has(e.operator)?3:e.operator===`\\cdot`?2:Math.max(o(e.operator,e),s(e));default:return s(e)}},Bo=(e,t)=>{let n=Fo.get(e);if(n!==void 0)return n;Fo.set(e,0);let r=e.kind===`Function`?e.bounds:[],i=Math.max($(e.body,void 0,t),...r.map(e=>$(e.set,void 0,t)));return Fo.set(e,i),i},Vo=(e,t,r,i=/* @__PURE__ */ new Set)=>{if(e.kind===`And`)return e.operands.flatMap(e=>Vo(e,t,r,i));if(e.kind===`Label`)return Vo(e.body,t,r,i);if(e.kind===`Identifier`){let a=H(e)?Nn(t,e.name):void 0;if(a?.kind===`Thunk`)return Vo(a.expression,a.scope,r,i);let o=r.constants.has(e.name)?void 0:Ln(e.name,r);if(!a&&o?.kind===`Operator`&&o.params.length===0){if(i.has(o))throw new n(`The definition of ${e.name} refers to itself`);return Vo(o.body,void 0,r,/* @__PURE__ */ new Set([...i,o]))}}let a=Lo(r,t);if(e.kind===`Apply`&&$(e,t,r)===3){let t=Qn(e,a),n=H(e)?void 0:Ln(e.operator,r);if(t?.kind===`Closure`&&!n?.isRecursive)return Vo(t.body,ur(t,e.args,a),r,i)}let o=e.kind===`Forall`&&$(e.body,t,r)===3&&e.bounds.every(e=>$(e.set,t,r)===0);if(e.kind===`Forall`&&o){let t=[];return Vn(e.bounds,a,n=>(t.push(...Vo(e.body,n,r,i)),!1)),t}return[{expression:e,scope:t}]},Ho=(e,t)=>{if(typeof e==`number`)return{kind:`Number`,value:e,location:t};if(typeof e==`string`)return{kind:`String`,value:e,location:t};if(typeof e==`boolean`)return{kind:`Identifier`,name:e?`TRUE`:`FALSE`,location:t}},Uo=(e,t)=>{let n=[];for(let r=t;r;r=r.parent){let t=r.binding,i=t.kind===`Operator`&&t.operator.kind===`Closure`?t.operator:void 0,a=t.kind===`Thunk`?t.expression:t.kind===`Value`?Ho(t.value,e.location):i?.body,o=t.kind===`Thunk`?t.scope===void 0:t.kind===`Value`||i?.scope===void 0;if(!a||!o)return;n.unshift({kind:`Operator`,name:r.name,params:i?.params??[],body:a,isLocal:!0,isRecursive:!1,location:a.location})}return n.length===0?e:{kind:`Let`,definitions:n,body:e,location:e.location}},Wo=(e,t,n)=>{let r=fr(e.definitions,Lo(n,t));for(let e=r;e&&e!==t;e=e.parent)e.binding.kind===`Thunk`&&Io.add(e.binding);return r},Go=(e,t)=>({kind:`AngleAction`,action:e,subscript:t,location:e.location}),Ko=(e,t,n)=>{let i=(e,t,i)=>{let a=i===0?$(e,t,n):i;if(a===0){let i=W(e,Lo(n,t));if(typeof i!=`boolean`)throw new r(`TLC expected a boolean in the temporal formula at ${Ro(e)}`);return i?no:ro}return a===1?{kind:`State`,expression:e,scope:t}:{kind:`Action`,expression:e,unchanged:void 0,scope:t}},a={depth:0},o=(e,t,n,o)=>{if(a.depth>=100)throw new r(`TLC overflowed the stack while expanding the temporal formula at ${Ro(n)}`);a.depth++;let s=l(e,t);a.depth--;let c=co(s);return c>2?s:i(n,o,c)},s=(e,t)=>{let r=e.kind===`Identifier`?e.name:e.operator,i=Lo(n,t),a=H(e)||Ln(r,n)===void 0?Nn(t,r):void 0;if(a?.kind===`Thunk`&&Io.has(a))return o(a.expression,a.scope,e,t);let s=a?.kind===`Operator`?a.operator:a?void 0:H(e)?$n(r,i):Xn(r,n);if(s?.kind!==`Closure`)throw zo(e);let c=e.kind===`Apply`?e.args:[];return o(s.body,ur(s,c,i),e,t)},c=(e,t)=>{if(!e.bounds.every(e=>$(e.set,t,n)===0))throw zo(e);let r=[];Vn(e.bounds,Lo(n,t),t=>(r.push(l(e.body,t)),!1));let a=e.kind===`Forall`;if(r.length===0)return a?no:ro;let o=Z(a?`And`:`Or`,r),s=co(o);return s>2?o:i(e,t,s)},l=(e,t)=>{let r=$(e,t,n);if(r<=2)return i(e,t,r);switch(e.kind){case`Label`:return l(e.body,t);case`Let`:return l(e.body,Wo(e,t,n));case`Identifier`:return s(e,t);case`Apply`:{let n=e.args;return e.operator===`~>`?X(`Always`,so(`Or`,X(`Not`,l(n[0],t)),X(`Eventually`,l(n[1],t)))):e.operator===`~`&&!H(e)?X(`Not`,l(n[0],t)):e.operator===`=>`?so(`Or`,X(`Not`,l(n[0],t)),l(n[1],t)):s(e,t)}case`And`:case`Or`:return Z(e.kind,e.operands.map(e=>l(e,t)));case`Forall`:case`Exists`:return c(e,t);case`If`:{if($(e.condition,t,n)===0){let r=W(e.condition,Lo(n,t));if(typeof r==`boolean`)return l(r?e.consequent:e.alternative,t)}let r=l(e.condition,t);return so(`Or`,so(`And`,r,l(e.consequent,t)),so(`And`,X(`Not`,r),l(e.alternative,t)))}case`Always`:case`Eventually`:return X(e.kind,l(e.expression,t));case`WeakFairness`:case`StrongFairness`:{let n=Go(e.action,e.subscript),r={kind:`Enabled`,step:e.enabled??n,scope:t},i=X(`Not`,r),a={kind:`Action`,expression:e.action,unchanged:{kind:`Unchanged`,expression:e.subscript,location:n.location},scope:t,enabled:r};return e.kind===`WeakFairness`?X(`Always`,X(`Eventually`,so(`Or`,i,a))):so(`Or`,X(`Eventually`,X(`Always`,i)),X(`Always`,X(`Eventually`,a)))}default:throw zo(e)}};return l(e,t)},qo=(e,t,n,i,a)=>{let o=e=>qo(e,t,n,i,a);switch(e.kind){case`Boolean`:return e.value;case`State`:case`Enabled`:{let n=a.get(e);if(n!==void 0)return n;let r={environment:i,scope:e.scope,state:t,next:void 0},o=e.kind===`State`?V(W(e.expression,r),`a temporal property predicate`):An(e.step,r);return a.set(e,o),o}case`Action`:{if(e.enabled&&a.get(e.enabled)===!1)return!1;let r={environment:i,scope:e.scope,state:t,next:n};return e.unchanged&&V(W(e.unchanged,r),`a subscript`)?!1:V(W(e.expression,r),`an action predicate`)}case`Not`:return!o(e.body);case`And`:return e.operands.every(o);case`Or`:return e.operands.some(o);case`Next`:return qo(e.body,n??t,void 0,i,/* @__PURE__ */ new Map);case`Always`:case`Eventually`:throw new r(`TLC cannot evaluate a temporal formula in a single step`)}},Jo=(e,t,n,r,i)=>{let a=e=>e+1<t.length?e+1:n,o=e=>t.map((e,t)=>t).filter(t=>t>=Math.min(e,n)),s=(e,a=r)=>Jo(e,t,n,a,i);switch(e.kind){case`Not`:return!s(e.body);case`And`:return e.operands.every(e=>s(e));case`Or`:return e.operands.some(e=>s(e));case`Next`:return s(e.body,a(r));case`Always`:return o(r).every(t=>s(e.body,t));case`Eventually`:return o(r).some(t=>s(e.body,t));default:return qo(e,t[r],t[a(r)],i,/* @__PURE__ */ new Map)}},Yo=/* @__PURE__ */ new WeakMap,Xo={value:0},Zo=e=>{let t=Yo.get(e);if(t!==void 0)return t;let n=e.kind===`Boolean`?String(e.value):`body`in e?`${e.kind}(${Zo(e.body)})`:`operands`in e?`${e.kind}(${e.operands.map(Zo).join(`,`)})`:`${e.kind}#${Xo.value++}`;return Yo.set(e,n),n},Qo=(e,t)=>e.every((e,n)=>ce(e,t[n])),$o=(e,t,n)=>{let r=new Int32Array(e).fill(-1),i=new Int32Array(e),a=new Uint8Array(e),o=[],s={value:0},c=/* @__PURE__ */ new Map,l=e=>{let n=c.get(e);if(n)return n;let r=t(e);return c.set(e,r),r};for(let t=0;t<e;t++){if(r[t]!==-1)continue;let e=[],u=t=>{r[t]=s.value,i[t]=s.value++,o.push(t),a[t]=1,e.push({node:t,position:0})};for(u(t);e.length>0;){let t=e[e.length-1],s=l(t.node);if(t.position<s.length){let e=s[t.position++];r[e]===-1?u(e):a[e]&&(i[t.node]=Math.min(i[t.node],r[e]));continue}e.pop();let d=e[e.length-1];if(d&&(i[d.node]=Math.min(i[d.node],i[t.node])),i[t.node]!==r[t.node])continue;let f=[];for(;;){let e=o.pop();if(e===void 0||(a[e]=0,f.push(e),e===t.node))break}let p=n(f,l);if(f.forEach(e=>c.delete(e)),p)return}}},es=(e,t,n,r)=>{if(e===t)return[e];let i=/* @__PURE__ */ new Map([[e,-1]]),a=[e];for(let e=0;e<a.length;e++)for(let o of r(a[e]))if(!i.has(o)&&n.has(o)){if(i.set(o,a[e]),o===t){let e=[];for(let n=t;n!==-1;n=i.get(n)??-1)e.push(n);return e.reverse()}a.push(o)}return[e]},ts=e=>e.filter((t,n)=>n===0||e[n-1]!==t),ns=(e,t,n)=>{if(e.length===0)return;let i=t.map(e=>Ko(e.expression,e.scope,n)),a=e.map(e=>X(`Not`,Ko(e.expression,e.scope,n))),o=a.length===1?a[0]:Z(`Or`,a),s=i.length===0?o:Z(`And`,[...i,o]),c=No(s);if(c.length===0)throw new r(`Temporal formula is a tautology (its negation is unsatisfiable)`);let l=c.map(e=>({solution:e,stateResults:[],actionResults:[],consistency:[],product:e.tableau&&{states:[],tableauNodes:[],edges:[],initial:[],parents:[]},productNodes:/* @__PURE__ */ new Map,nodesByState:/* @__PURE__ */ new Map})),u=/* @__PURE__ */ new Map,d=l.map(e=>e.solution.actionChecks.map(e=>{let t=Zo(e),n=u.get(t);return n===void 0?(u.set(t,u.size),u.size-1):n})),f=[],p=[],m=[],h=[],g=(e,t,r)=>e.every(e=>qo(e,t,void 0,n,r)),_=(e,t,n,r,i)=>{let a=n*(e.solution.tableau?.nodes.length??1)+r,o=e.productNodes.get(a);if(o!==void 0)return{node:o,isNew:!1};let s=t.states.length;e.productNodes.set(a,s),t.states.push(n),t.tableauNodes.push(r),t.edges.push([]),t.parents.push(i);let c=e.nodesByState.get(n);return c?c.push(s):e.nodesByState.set(n,[s]),{node:s,isNew:!0}},v=(t,r)=>{let i=t.map(e=>f[e]);return(e.find((e,t)=>!Jo(a[t].body,i,r,0,n))??e[0]).name},y=(e,t,n,r)=>{let i=e.solution.models.some(e=>e.eventuallyAlways.length===0&&e.infinitelyOftenStates.length===0&&e.infinitelyOftenActions.length===0),a=n.nodes.length,o=(e.nodesByState.get(r)??[]).map(e=>({node:e,isDone:!1}));for(;o.length>0;){let r=o.pop();if(!r)break;let s=t.states[r.node],c=n.nodes[t.tableauNodes[r.node]].successors;if(r.isDone&&i&&c.some(e=>{let t=n.nodes[e];return t.particle.length===0&&t.successors.every(t=>t===e)})){let e=ts(w(t,r.node).map(e=>t.states[e]));return{name:v(e,e.length-1),path:e}}let l=e.consistency[s];p[s].forEach((n,i)=>{for(let s of c){if(!l[i*a+s])continue;let c=_(e,t,n,s,r.node);t.edges[r.node].push(c.node,i),c.isNew&&p[n]!==void 0&&o.push({node:c.node,isDone:!0})}})}},ee=(e,t)=>{h.push(e),f[e]=t;for(let n of l){let r=n.solution.tableau,i=n.product;if(!r||!i)continue;let a=/* @__PURE__ */ new Map;for(let o=0;o<r.initialCount;o++)g(r.nodes[o].statePredicates,t,a)&&i.initial.push(_(n,i,e,o,-1).node)}},b=(e,t,r)=>{f[e]=t;let i=[],a=/* @__PURE__ */ new Map;for(let n of[...r,{index:e,state:t}]){let t=a.get(n.index);t!==void 0&&(n.index<e||t.some(e=>Qo(e.state,n.state)))||(i.push(n),t?t.push(n):a.set(n.index,[n]))}p[e]=i.map(e=>e.index),m[e]=i.map(e=>e.state);let o=/* @__PURE__ */ new Map,s=i.map(()=>/* @__PURE__ */ new Map);for(let r of l){let a=r.solution;r.stateResults[e]=Uint8Array.from(a.stateChecks,e=>+!!qo(e,t,void 0,n,o));let c=a.tableau,l=r.product;if(!c||!l)continue;let u=c.nodes.length,d=new Uint8Array(i.length*u);i.forEach((e,t)=>{c.nodes.forEach((n,r)=>{let i=g(n.statePredicates,e.state,s[t]);d[t*u+r]=+!!i})}),r.consistency[e]=d;let f=y(r,l,c,e);if(f)return f}},x=e=>{let t=f[e],r=m[e],i=r.map(()=>new Int8Array(u.size).fill(-1));l.forEach((a,o)=>{let s=a.solution,c=d[o],l=a.stateResults[e],u=new Map(s.stateChecks.map((e,t)=>[e,l[t]===1])),f=s.actionChecks.length,p=new Uint8Array(r.length*f);r.forEach((e,r)=>{let a=i[r];for(let i=0;i<f;i++){let o=c[i];if(a[o]===-1){let r=s.actionChecks[i];a[o]=+!!qo(r,t,e,n,u)}p[r*f+i]=a[o]}}),a.actionResults[e]=p})},S=(e,t)=>(e.actionResults[t]===void 0&&x(t),e.actionResults[t]),C=e=>e.product??{states:f.map((e,t)=>t),tableauNodes:f.map(()=>-1),edges:p.map(e=>e.flatMap((e,t)=>[e,t])),initial:h,parents:[]},w=(e,t)=>{if(e.parents.length>0){let n=[];for(let r=t;r!==-1;r=e.parents[r])n.push(r);return n.reverse()}let n=new Map(e.initial.map(e=>[e,-1])),r=[...e.initial];for(let i=0;i<r.length&&!n.has(t);i++){let t=e.edges[r[i]];for(let e=0;e<t.length;e+=2)n.has(t[e])||(n.set(t[e],r[i]),r.push(t[e]))}let i=[];for(let e=t;e!==-1;e=n.get(e)??-1)i.push(e);return i.reverse()},te=e=>{let t=e.solution,n=t.tableau,r=C(e),i=t.actionChecks.length,a=(t,n,a)=>S(e,r.states[t])[n*i+a]===1;for(let i of t.models){let o=(e,t)=>i.eventuallyAlways.every(n=>a(e,t,n)),s=e=>{let t=r.edges[e],n=[];for(let r=0;r<t.length;r+=2)o(e,t[r+1])&&n.push(t[r]);return n},c={value:void 0};if($o(r.states.length,s,(s,l)=>{let u=new Set(s);if(s.length===1&&!l(s[0]).includes(s[0]))return!1;let d=i.infinitelyOftenStates.map(t=>s.find(n=>e.stateResults[r.states[n]][t]===1)),f=i.infinitelyOftenActions.map(e=>{for(let t of s){let n=r.edges[t];for(let r=0;r<n.length;r+=2)if(u.has(n[r])&&o(t,n[r+1])&&a(t,n[r+1],e))return[t,n[r]]}}),p=t.promises.map(e=>s.find(t=>n!==void 0&&Ao(n.nodes[r.tableauNodes[t]].particle,e)));if(!(d.every(e=>e!==void 0)&&f.every(e=>e!==void 0)&&p.every(e=>e!==void 0)))return!1;let m=s[s.length-1],h=[...d.flatMap(e=>e===void 0?[]:[e]),...f.flatMap(e=>e??[]),...p.flatMap(e=>e===void 0?[]:[e])],g=[m];for(let e of h)g.push(...es(g[g.length-1],e,u,l).slice(1));g.length===1&&!l(m).includes(m)&&g.push(l(m).find(e=>u.has(e))??m);let _=es(g[g.length-1],m,u,l);g.push(..._.slice(1,-1));let y=ts(w(r,m).map(e=>r.states[e])),ee=ts(g.map(e=>r.states[e]));return ee.length>1&&ee[ee.length-1]===ee[0]&&ee.pop(),y.pop(),c.value={name:v([...y,...ee],y.length),prefix:y,cycle:ee},!0}),c.value)return c.value}};return{addInitialState:ee,addState:b,findViolation:()=>{for(let e of l){let t=te(e);if(t)return t}}}},rs=e=>[...e].map(([e,t])=>`${e}>${t.name}`).sort().join(`,`),is=(e,t)=>{let n=/* @__PURE__ */ new Map;return(/* @__PURE__ */ new Set([...e.keys(),...t.keys()])).forEach(r=>{let i=e.get(r),a=i?t.get(i.name)??i:t.get(r);a&&a.name!==r&&n.set(r,a)}),n},as=(e,t)=>{if(!S(e))throw new n(`The symmetry values of ${t} must be functions`);let r=F(e),i=/* @__PURE__ */ new Map;return r.domain.forEach((e,t)=>{let a=r.range[t];if(!C(e)||!C(a))throw new n(`Symmetry function must have model values as domain and range`);e.name!==a.name&&i.set(e.name,a)}),i},os=(e,t)=>{let r=t.definitions.get(e);if(r?.kind!==`Operator`||r.params.length>0)throw new n(`The symmetry function ${e} must specify a set of permutations`);let i=W(r.body,{environment:t,scope:void 0,state:void 0,next:void 0});if(!x(i)||!M(i))throw new n(`The symmetry operator must specify a set of functions`);let a=N(i).elements.map(t=>as(t,e));if(r.body.kind===`Apply`&&r.body.args.length>=a.length)return[];let o=/* @__PURE__ */ new Map;a.forEach(e=>{e.size>0&&o.set(rs(e),e)});let s=[...o.values()],c={start:0};for(;c.start<o.size;){let e=[...o.values()],t=e.length;s.forEach(n=>e.slice(c.start,t).forEach(e=>{let t=is(n,e),r=rs(t);t.size>0&&!o.has(r)&&o.set(r,t)})),c.start=t}let l=Math.max(256,Math.floor(cs/o.size));return[...o.values()].map(e=>({images:e,cache:/* @__PURE__ */ new WeakMap,cacheSize:0,cacheLimit:l}))},ss=(e,t)=>{for(let n=0;n<e.length;n++){let r=e[n],i=us(r,t);if(i===r)continue;let a=e.slice(0,n);a.push(i);for(let r=n+1;r<e.length;r++)a.push(us(e[r],t));return a}},cs=1<<22,ls=e=>e.kind===`Set`?e.elements.length:e.kind===`Function`?e.domain.length:0,us=(e,t)=>{if(typeof e!=`object`)return e;if(e.kind===`ModelValue`)return t.images.get(e.name)??e;let n=ls(e);if(n===0||n>16)return ds(e,t);let r=t.cache.get(e);if(r!==void 0)return r;let i=ds(e,t);return t.cacheSize>=t.cacheLimit&&(t.cache=/* @__PURE__ */ new WeakMap,t.cacheSize=0),t.cache.set(e,i),t.cacheSize++,i},ds=(e,t)=>{let n=e.kind;if(n===`Set`){let n=ss(e.elements,t);return n?A(n):e}if(n===`Function`||n===`LazyFunction`&&M(e.domain)){let n=F(e),r=ss(n.domain,t),i=ss(n.range,t)??n.range;return r?pe(r.map((e,t)=>[e,i[t]])):i===n.range?n:O(n.domain,i)}if(n===`Interval`||!x(e)||!M(e))return e;let r=N(e),i=ss(r.elements,t);return i?A(i):r},fs=(e,t,n)=>{for(let r=t.length;r<e.length;r++)t.push(us(e[r],n));return t},ps=(e,t,n)=>{let r=[];for(let i=0;i<e.length;i++){let a=us(e[i],n),o=T(a,t[i]);if(o>0)return;if(r.push(a),o<0)return fs(e,r,n)}},ms=(e,t)=>t.reduce((t,n)=>ps(e,t,n)??t,e),hs=(e,t)=>{for(let n=0;n<e.length;n++)e[n]=t(e[n])},gs=()=>{let e=/* @__PURE__ */ new Map,t=n=>{if(typeof n!=`object`||n.kind!==`Set`&&n.kind!==`Function`)return n;let r=Le(n),i=e.get(r);if(i!==void 0&&!Array.isArray(i)&&(i===n||ce(i,n)))return i;if(Array.isArray(i)){for(let e=0;e<i.length;e++)if(i[e]===n||ce(i[e],n))return i[e]}return n.kind===`Set`?hs(n.elements,t):(hs(n.domain,t),hs(n.range,t)),i===void 0?e.set(r,n):Array.isArray(i)?i.push(n):e.set(r,[i,n]),n};return e=>{for(let n=0;n<e.length;n++)e[n]=t(e[n]);return e}},_s={line:0,column:0},vs=e=>({kind:`Identifier`,name:e,location:_s}),ys=(e,t)=>{let r=Ln(e,t);if(r?.kind!==`Operator`||r.params.length>0)throw new n(`${e} is not defined as an operator without arguments`);return r.body},bs=(e,t)=>{if(e.kind===`And`)return e.operands.flatMap(e=>bs(e,t));if(e.kind===`Identifier`&&!t.constants.has(e.name)){let n=Ln(e.name,t);if(n?.kind===`Operator`&&n.params.length===0)return bs(n.body,t)}return[e]},xs=(e,t)=>{if(e.specification===void 0){if(e.init===void 0)throw new n(`The configuration file did not specify the initial state predicate`);if(e.next===void 0)throw new n(`The configuration does not specify NEXT`);return ys(e.init,t),ys(e.next,t),{init:vs(e.init),next:vs(e.next),temporals:[]}}let r=[],a=[],o=[],s=ys(e.specification,t),c=(t,n)=>{let r=Uo(t,n);if(!r)throw new i(`The specification ${e.specification} has an initial predicate or next-state relation inside a quantified formula`);return r};if(Vo(s,void 0,t).forEach(i=>{let s=i.expression;if(s.kind===`Always`&&s.expression.kind===`BoxAction`){a.push(c(s.expression.action,i.scope));return}if(s.kind===`Always`&&$(s.expression,i.scope,t)<2)throw new n(`TLC cannot handle []P in the specification ${e.specification} when P is a state predicate`);let l=$(s,i.scope,t);if(l===3)o.push(i);else{if(l===2)throw new n(`TLC cannot handle the action-level conjunct of the specification ${e.specification}`);r.push(c(s,i.scope))}}),a.length!==1)throw new n(`The specification ${e.specification} must contain exactly one [][Next]_vars`);return{init:{kind:`And`,operands:r,location:_s},next:a[0],temporals:o}},Ss=(e,t)=>{let r={initialPredicates:[],invariants:[],actionProperties:[],liveness:[]};return e.properties.forEach(e=>{let i=ys(e,t);Vo(i,void 0,t).forEach(i=>{let a=i.expression;if(a.kind===`Always`&&a.expression.kind===`BoxAction`){r.actionProperties.push({name:e,action:a.expression.action,subscript:a.expression.subscript,scope:i.scope});return}if(a.kind===`Always`&&$(a.expression,i.scope,t)<=1){r.invariants.push({name:e,expression:a.expression,scope:i.scope});return}let o=$(a,i.scope,t);if(o<2)r.initialPredicates.push({name:e,expression:a,scope:i.scope});else{if(o===2)throw new n(`The property ${e} is an action-level formula`);r.liveness.push({name:e,expression:a,scope:i.scope})}})}),r},Cs=(e,t)=>e.map(e=>(ys(e,t),{name:e,expression:vs(e),scope:void 0})),ws=(e,t)=>e.flatMap(e=>bs(e.expression,t).map(n=>({name:e.name,expression:n,scope:e.scope,variables:Xr(n,t)}))),Ts=(e,t,n)=>{let r=e.variables;if(!n||!r)return!1;for(let e=0;e<r.length;e++)if(t[r[e]]!==n[r[e]])return!1;return!0},Es=(e,t,n,r)=>({environment:e,scope:r,state:t,next:n}),Ds=(e,t,n)=>V(W(e,t),n),Os=()=>{},ks=(e,t,n)=>e.forEach(e=>{let r=t.possibleCounts.get(e.name)??0,i=Ds(e.expression,n,`_POSSIBLE ${e.name}`);t.possibleCounts.set(e.name,i?r+1:r)}),As=(e,t,n)=>{try{return Ds(e,Es(t,void 0,void 0),n)?void 0:{message:void 0}}catch(e){if(e instanceof r)return{message:e.message};throw e}},js=(e,t)=>{for(let n of e.filter(e=>!e.isAxiom)){let e=As(n.expression,t,`an assumption`);if(e)return{name:n.name??`line ${n.location.line}, column ${n.location.column}`,trace:[],message:e.message}}},Ms=(e,t)=>{let n=Ss(e,t),r=ws([...Cs(e.invariants,t),...n.invariants],t);if(e.specification===void 0&&e.init===void 0&&t.variables.length===0)return;let i=xs(e,t);if(t.variables.length===0)return;let a=e.symmetry===void 0?[]:os(e.symmetry,t),o=e.view===void 0?void 0:Cs([e.view],t)[0],s=ws(Cs(e.constraints,t),t),c=Cs(e.actionConstraints,t),l=n.actionProperties.map(e=>{let t={kind:`Unchanged`,expression:e.subscript,location:_s};return{...e,unchanged:t}}),u=Cs(e.possible,t),d=e=>$(e.expression,void 0,t)>=2,f=u.filter(e=>!d(e)),p=u.filter(d),m=t.runtime;return{properties:n,spec:i,isSymmetric:a.length>0,getFingerprintState:e=>{let n=a.length===0?e:ms(e,a);return o===void 0?n:[W(o.expression,Es(t,n,void 0))]},findViolatedInvariant:(e,n)=>r.find(r=>!Ts(r,e,n)&&!Ds(r.expression,Es(t,e,void 0,r.scope),`invariant ${r.name}`)),satisfiesConstraints:(e,n)=>s.every(r=>Ts(r,e,n)||Ds(r.expression,Es(t,e,void 0),`constraint ${r.name}`)),findFailedInitialPredicate:e=>n.initialPredicates.find(n=>!Ds(n.expression,Es(t,e,void 0,n.scope),`property ${n.name}`)),findViolatedActionProperty:(e,n)=>l.find(r=>!Ds(r.action,Es(t,e,n,r.scope),`property ${r.name}`)&&!Ds(r.unchanged,Es(t,e,n,r.scope),`a subscript`)),satisfiesActionConstraints:(e,n)=>c.every(r=>Ds(r.expression,Es(t,e,n),`action constraint ${r.name}`)),trackStatePossible:f.length===0?Os:e=>ks(f,m,Es(t,e,void 0)),trackActionPossible:p.length===0?Os:(e,n)=>ks(p,m,Es(t,e,n)),findPostconditionViolation:n=>{let r=u.find(e=>!m.possibleCounts.get(e.name));if(r)return n(I(ui(m),!0)),{name:r.name,trace:[],message:`The _POSSIBLE predicate ${r.name} was never witnessed.`};for(let n of e.postconditions){let e=As(vs(n),t,`a postcondition`);if(e)return{name:n,trace:[],message:e.message??`Postcondition ${n} is false.`}}}}},Ns=e=>{let t=typeof e.config==`string`?ee(e.config):e.config,n=e.onPrint??console.log,r=to(si(e.source),t,{loadModule:e.loadModule,print:n,files:{readFile:e.readFile,writeFile:e.writeFile}}),i=r.environment,a=i.runtime,o={depth:0},s=(e,t)=>({status:e,violation:t&&{...t,loopStart:t.loopStart},generatedStates:a.generatedStates,distinctStates:a.distinctStates,depth:o.depth}),c=js(r.assumptions,i);if(c)return s(`assumption-violation`,c);let l=Ms(t,i);if(!l)return s(`success`);let u=l.properties,d=l.spec,f=l.getFingerprintState,p=ns(u.liveness,d.temporals,i),m=l.isSymmetric||p!==void 0,h=[],g=[],_=[],v=[],y=[],b=/* @__PURE__ */ new Map,x=gs(),S=e=>Object.fromEntries(i.variables.map((t,n)=>[t,e[n]])),C=(e,t)=>{let n=t?[{action:t.action,state:S(t.state)}]:[];for(let t=e;t!==-1;t=_[t])n.push({action:v[t],state:S(h[t])});return n.reverse()},w=e=>e.map((t,n)=>{if(n===0)return{action:void 0,state:S(h[t])};let r=e[n-1];return{action:r===t?`Stuttering`:Mn(d.next,h[r],i).find(e=>ne(e.state,h[t]))?.action,state:S(h[t])}}),te=e=>{let t=2166136261;for(let n=0;n<e.length;n++)t=Me(t,Le(e[n]));return t&1073741823},ne=(e,t)=>{for(let n=0;n<t.length;n++)if(!ce(e[n],t[n]))return!1;return!0},re=(e,t)=>{let n=b.get(e);return n===void 0?-1:typeof n==`number`?ne(g[n],t)?n:-1:n.find(e=>ne(g[e],t))??-1},ie=(e,t)=>{let n=b.get(e);n===void 0?b.set(e,t):typeof n==`number`?b.set(e,[n,t]):n.push(t)},ae=e=>{a.distinctStates=h.length+1,o.depth=Math.max(o.depth,e),a.diameter=Math.max(a.diameter,e)},T=(e,t,n,r)=>{let i=n===-1?1:y[n]+1;h.push(e),g.push(t),_.push(n),v.push(r),y.push(i)},E={index:-1,isExpanding:!1,candidate:void 0,candidateLevel:0},oe=e=>e===-1?[]:[...oe(_[e]),h[e]];a.getBehavior=e=>{let t=e===E.candidate?-1:h.indexOf(e);return t===-1?[...oe(E.index),e]:oe(t)},a.getLevel=e=>e===E.candidate?E.candidateLevel:E.index===-1?0:e===h[E.index]?y[E.index]:E.isExpanding?y[E.index]+1:0;for(let e of jn(d.init,i)){x(e),a.generatedStates++,a.initialStates++,E.candidate=e,E.candidateLevel=1;let t=f(e),n=te(t),r=re(n,t)!==-1,i=r||l.satisfiesConstraints(e);if(i&&l.trackStatePossible(e),r)continue;i&&(ae(1),a.queueSize++,p?.addInitialState(h.length,e));let o=l.findViolatedInvariant(e);if(o)return s(`invariant-violation`,{name:o.name,trace:[{action:void 0,state:S(e)}]});let c=l.findFailedInitialPredicate(e);if(c)return s(`liveness-violation`,{name:c.name,trace:[{action:void 0,state:S(e)}]});i&&(ie(n,h.length),T(e,t,-1,void 0))}for(let e=0;e<h.length&&!a.isStopped;e++){let n=h[e];E.index=e,a.queueSize=h.length-e-1,E.isExpanding=!0;let r=Mn(d.next,n,i);if(E.isExpanding=!1,r.length===0&&t.checkDeadlock)return s(`deadlock`,{name:`deadlock`,trace:C(e)});let o=[];for(let t of r){a.generatedStates++,E.candidate=t.state,E.candidateLevel=y[e]+1,m&&x(t.state);let r=f(t.state),i=te(r),c=re(i,r),u=c!==-1||l.satisfiesConstraints(t.state,n);u&&l.trackStatePossible(t.state);let d=u&&l.satisfiesActionConstraints(n,t.state);d&&l.trackActionPossible(n,t.state);let g=d?c:-1;if(g!==-1&&p){let e=h[g],n=e.every((e,n)=>e===t.state[n]);o.push({index:g,state:n?e:t.state})}let _=d&&g===-1;if(_&&ae(y[e]+1),g===-1){let r=l.findViolatedInvariant(t.state,n);if(r)return s(`invariant-violation`,{name:r.name,trace:C(e,t)})}let v=l.findViolatedActionProperty(n,t.state);if(v)return s(`liveness-violation`,{name:v.name,trace:C(e,t)});_&&(m||x(t.state),ie(i,h.length),p&&o.push({index:h.length,state:t.state}),T(t.state,r,e,t.action),a.queueSize++)}let c=p?.addState(e,n,o);if(c)return s(`property-violation`,{name:c.name,trace:w(c.path)})}E.index=-1,E.candidate=void 0;let D=p?.findViolation();if(D)return s(`liveness-violation`,{name:D.name,trace:w([...D.prefix,...D.cycle]),loopStart:D.prefix.length});let O=l.findPostconditionViolation(n);return O?s(`postcondition-violation`,O):s(`success`)},Ps=e=>{let t=Math.imul(e^e>>>16,2146121005),n=Math.imul(t^t>>>15,2221713035);return n^n>>>16},Fs=(e,t)=>{let n=2166136261,r=1779033703;for(let t=0;t<e.length;t++)n=Math.imul(n^Le(e[t]),16777619),r=Math.imul(r^We(e[t]),1540483477);t[0]=Ps(n)||1,t[1]=Ps(r)},Is=(e,t)=>(e>>>0)%t,Ls=()=>{let e={slots:/* @__PURE__ */ new Int32Array(8192),used:0},t=(e,t,n)=>{let r=e.length/2-1;for(let i=t&r;;i=i+1&r){let r=e[i*2];if(r===0&&e[i*2+1]===0||r===t&&e[i*2+1]===n)return i}},n=()=>{let n=e.slots,r=new Int32Array(n.length*2);for(let e=0;e<n.length;e+=2){if(n[e]===0)continue;let i=t(r,n[e],n[e+1]);r[i*2]=n[e],r[i*2+1]=n[e+1]}e.slots=r};return{insert:(r,i)=>{e.used*4>=e.slots.length&&n();let a=t(e.slots,r,i);return e.slots[a*2]!==r&&(e.slots[a*2]=r,e.slots[a*2+1]=i,e.used++,!0)},remove:(n,r)=>{let i=t(e.slots,n,r);e.slots[i*2]===n&&(e.slots[i*2]=0,e.slots[i*2+1]=1)}}},Rs=()=>{let e={words:/* @__PURE__ */ new Int32Array(1024),length:0,count:0},t=[],n=/* @__PURE__ */ new Map,r=t=>{if(e.length===e.words.length){let t=new Int32Array(e.words.length*2);t.set(e.words),e.words=t}e.words[e.length++]=t},i=e=>{let i=n.get(e);if(i!==void 0)return r(i);n.set(e,t.length),r(t.length),t.push(e)},a=e=>typeof e==`boolean`?(r(+!!e),!0):typeof e==`number`?(e|0)===e&&(r(2),r(e),!0):typeof e==`string`?(r(3),i(e),!0):e.kind===`ModelValue`?(r(4),i(e.name),!0):e.kind===`Set`?(r(5),r(e.elements.length),e.elements.every(a)):e.kind===`Function`&&(r(6),r(e.domain.length),e.domain.every(a)&&e.range.every(a));return{encode:t=>{let n=e.length;return t.every(a)?(e.count++,!0):(e.length=n,!1)},finish:()=>({words:e.words.slice(0,e.length),strings:t,count:e.count})}},zs=e=>t=>{let n=t.words,r={index:0},i=e=>Array.from({length:e},()=>a()),a=()=>{let e=n[r.index++];if(e===0)return!1;if(e===1)return!0;if(e===2)return n[r.index++];if(e===3)return t.strings[n[r.index++]];if(e===4)return oe(t.strings[n[r.index++]]);let a=n[r.index++];if(e===5)return D(i(a));let o=i(a);return O(o,i(a))};return Array.from({length:t.count},()=>Array.from({length:e},()=>a()))};Object.defineProperty(exports,"S",{enumerable:!0,get:function(){return i}}),Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return ee}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return Fs}}),Object.defineProperty(exports,"b",{enumerable:!0,get:function(){return r}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return js}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return si}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return In}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return I}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return Mn}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Is}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return gs}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return jn}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return Rs}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Ns}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return gr}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Ls}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return Ms}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return zs}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return to}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return n}}),Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return t}}),Object.defineProperty(exports,"y",{enumerable:!0,get:function(){return e}});
+    IF TLCGet("level") >= _TETraceLength
+       THEN _TETraceLength
+       ELSE IF TLCGet("level") = 0 THEN 1 ELSE TLCGet("level")
+=============================================================================
+`],[`_Possible`,`------------------------------ MODULE _Possible ------------------------------
+LOCAL INSTANCE TLC
+LOCAL INSTANCE TLCExt
+LOCAL INSTANCE Naturals
+LOCAL INSTANCE Sequences
+LOCAL _Update(Op(_,_), val) ==
+    TLCSet("s:_possible", Op(TLCGetOrDefault("s:_possible", <<>>), val))
+_Track(expr, name) ==
+    _Update(LAMBDA old, b:
+        IF b
+        THEN
+            IF name \\in DOMAIN old
+            THEN [old EXCEPT ![name] = @ + 1]
+            ELSE old @@ (name :> 1)
+        ELSE old @@ (name :> 0), expr)
+LOCAL _Merge(a, b) ==
+    [name \\in (DOMAIN a) \\cup (DOMAIN b) |->
+        (IF name \\in DOMAIN a THEN a[name] ELSE 0) +
+        (IF name \\in DOMAIN b THEN b[name] ELSE 0)]
+_Counts ==
+    LET workers == TLCGet("all:named")["s:_possible"]
+        n == Len(workers)
+        Fold[i \\in 0..n] ==
+            IF i = 0 THEN <<>>
+            ELSE _Merge(Fold[i-1], workers[i])
+    IN Fold[n]
+_CheckName(name) ==
+    LET counts == _Counts
+    IN (name \\notin DOMAIN counts \\/ counts[name] = 0)
+       => (PrintT(counts) /\\ FALSE)
+_PrintCounts == PrintT(_Counts)
+=============================================================================
+`]]),nu=/* @__PURE__ */ new Map([[`FiniteSets`,/* @__PURE__ */ new Map([[`IsFiniteSet`,`public static tlc2.value.IBoolValue tlc2.module.FiniteSets.IsFiniteSet(tlc2.value.impl.Value)`],[`Cardinality`,`public static tlc2.value.impl.IntValue tlc2.module.FiniteSets.Cardinality(tlc2.value.impl.Value)`]])],[`Sequences`,/* @__PURE__ */ new Map([[`Seq`,`public static tlc2.value.impl.Value tlc2.module.Sequences.Seq(tlc2.value.impl.Value)`],[`Len`,`public static tlc2.value.impl.IntValue tlc2.module.Sequences.Len(tlc2.value.impl.Value)`],[`Head`,`public static tlc2.value.impl.Value tlc2.module.Sequences.Head(tlc2.value.impl.Value)`],[`Tail`,`public static tlc2.value.impl.Value tlc2.module.Sequences.Tail(tlc2.value.impl.Value)`],[`Append`,`public static tlc2.value.impl.Value tlc2.module.Sequences.Append(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`\\o`,`public static tlc2.value.impl.Value tlc2.module.Sequences.Concat(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`SubSeq`,`public static tlc2.value.impl.Value tlc2.module.Sequences.SubSeq(tlc2.value.impl.Value,tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`SelectSeq`,`public static tlc2.value.impl.Value tlc2.module.Sequences.SelectSeq(tlc2.value.impl.Value,tlc2.value.impl.Value)`]])],[`TLC`,/* @__PURE__ */ new Map([[`Print`,`public static tlc2.value.impl.Value tlc2.module.TLC.Print(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`PrintT`,`public static tlc2.value.impl.Value tlc2.module.TLC.PrintT(tlc2.value.impl.Value)`],[`ToString`,`public static tlc2.value.impl.Value tlc2.module.TLC.ToString(tlc2.value.impl.Value)`],[`Assert`,`public static tlc2.value.impl.Value tlc2.module.TLC.Assert(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`:>`,`public static tlc2.value.impl.Value tlc2.module.TLC.MakeFcn(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`@@`,`public static tlc2.value.impl.Value tlc2.module.TLC.CombineFcn(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`SortSeq`,`public static tlc2.value.impl.Value tlc2.module.TLC.SortSeq(tlc2.value.impl.Value,tlc2.value.impl.Value)`],[`Permutations`,`public static tlc2.value.impl.Value tlc2.module.TLC.Permutations(tlc2.value.impl.Value)`],[`RandomElement`,`public static tlc2.value.impl.Value tlc2.module.TLC.RandomElement(tlc2.value.impl.Value)`],[`TLCEval`,`public static tlc2.value.impl.Value tlc2.module.TLCEval.tlcEval(tlc2.tool.impl.Tool,tla2sany.semantic.ExprOrOpArgNode[],tlc2.util.Context,tlc2.tool.TLCState,tlc2.tool.TLCState,int,tlc2.tool.coverage.CostModel)`]])]]),ru=(e,t)=>e.every(e=>B(e,t)),iu=pt([!1,!0]),au=(e,t,n)=>{if(n-t===1)return e[t];let r=t+n>>1;return vt(au(e,t,r),au(e,r,n))},ou=[`\\cup`,`\\cap`,`\\`],su=e=>typeof e==`object`&&(e.kind===`Set`||e.kind===`MixedSet`||e.kind===`Interval`),cu=e=>typeof e==`object`&&e.kind===`MixedSet`,lu=e=>e.kind===`Interval`?R(e).elements:e.elements,uu=(e,t,n)=>{let r=lu(t);if(e!==`\\cup`){let t=e===`\\cap`;return mt(r.filter(e=>B(e,n)===t))}if(r.length===0)return n;if(!su(n))return{kind:`SetOperation`,operator:e,left:t,right:n};let i=R(n).elements.filter(e=>!B(e,t));return mt([...r,...i])},du=[Vn(`TRUE`,!0),Vn(`FALSE`,!1),Vn(`BOOLEAN`,iu),Vn(`STRING`,{kind:`InfiniteSet`,name:`STRING`}),Wn(`=`,dt),Wn(`#`,(e,t)=>!dt(e,t)),W(`~`,1,e=>!Nn(e,0,`~`)),W(`<=>`,2,e=>Nn(e,0,`<=>`)===Nn(e,1,`<=>`)),W(`/\\`,2,e=>Nn(e,0,`/\\`)&&Nn(e,1,`/\\`)),W(`\\/`,2,e=>Nn(e,0,`\\/`)||Nn(e,1,`\\/`)),W(`=>`,2,e=>!Nn(e,0,`=>`)||Nn(e,1,`=>`)),W(`\\in`,2,e=>B(U(e,0,`\\in`),U(e,1,`\\in`))),W(`\\notin`,2,e=>!B(U(e,0,`\\notin`),U(e,1,`\\notin`))),W(`\\subseteq`,2,e=>{let t=Pn(e,0,`\\subseteq`),n=Pn(e,1,`\\subseteq`);return typeof t==`object`&&t.kind===`Subset`&&typeof n==`object`&&n.kind===`Subset`&&L(t.base)?ru(R(t.base).elements,n.base):ru(R(t).elements,n)}),...ou.map(e=>W(e,2,t=>{let n=Pn(t,0,e),r=Pn(t,1,e);return su(n)&&su(r)&&!cu(n)&&!cu(r)?e===`\\cup`&&z(n)?r:(e===`\\cup`?vt:e===`\\cap`?_t:gt)(R(n),R(r)):su(n)?uu(e,n,r):e!==`\\`&&su(r)?uu(e,r,n):{kind:`SetOperation`,operator:e,left:n,right:r}})),W(`SUBSET`,1,e=>({kind:`Subset`,base:Pn(e,0,`SUBSET`)})),W(`UNION`,1,e=>{let t=Pn(e,0,`UNION`),n=$e(t)?t.elements.filter($e):[];if(!$e(t)||n.length!==t.elements.length)return{kind:`Union`,base:t};if(cu(t)||n.some(cu)){let e={kind:`MixedSet`,elements:[]};return n.forEach(t=>t.elements.forEach(t=>{B(t,e)||e.elements.push(t)})),mt(e.elements)}return n.length===0?ht:au(n.map(R),0,n.length)}),W(`DOMAIN`,1,e=>{let t=U(e,0,`DOMAIN`);if(!k(t))throw new f(`DOMAIN expects a function but received ${H(t)}`);return en(t)})],fu=tr(`DotDot`,`IntervalValue`,2),pu=tr(`Neg`,`IntValue`,1),mu=[Vn(`Nat`,{kind:`InfiniteSet`,name:`Nat`}),nr(`+`,`Plus`,(e,t)=>e+t),nr(`-`,`Minus`,(e,t)=>e-t),nr(`*`,`Times`,(e,t)=>e*t),nr(`^`,`Expt`,(e,t)=>{if(t<0)throw new p(`The second argument of ^ should be a natural number, but instead it is:\n${t}`);if(e===0&&t===0)throw new p(`0^0 is undefined.`);return e**t}),nr(`\\div`,`Divide`,(e,t)=>{if(t===0)throw new p(`The second argument of \\div is 0.`);let n=Math.floor(e/t);if(Gn(n))throw Kn(`${e} \\div ${t}`);return n}),nr(`%`,`Mod`,(e,t)=>{if(t<=0)throw new p(`The second argument of % should be a positive number, but instead it is:\n${t}`);return(e%t+t)%t}),ir(`<`,(e,t)=>e<t),ir(`>`,(e,t)=>e>t),ir(`<=`,(e,t)=>e<=t),ir(`>=`,(e,t)=>e>=t),W(`..`,2,e=>({kind:`Interval`,low:er(U(e,0,`..`),fu),high:er(U(e,1,`..`),fu)}))],hu=[Vn(`Int`,{kind:`InfiniteSet`,name:`Int`}),W(`-.`,1,e=>{let t=er(U(e,0,`-`),pu);if(Gn(-t))throw Kn(`-${t}`);return-t})],gu=(e,t,n)=>{let r=U(e,t,n),i=qt(r);if(!i)throw new p(`${n}\n${H(r)}`);return i},_u=(e,t,n)=>{let r=U(e,t,n);return typeof r==`string`?r:gu(e,t,n)},vu=(e,t,n)=>typeof e==`string`?M(e.slice(t,n)):I(e.slice(t,n)),yu=(e,t)=>`The ${e}argument of ${t} should be a sequence, but instead it is:`,bu=(e,t)=>`Evaluating an expression of the form ${e} when s is not a ${t}:`,xu=(e,t)=>{let n=nu.get(e);return n?t.map(e=>{let t=n.get(e.name);return t?$n(e,t):e}):t},Su=xu(`Sequences`,[W(`Seq`,1,e=>({kind:`SequenceSet`,base:U(e,0,`Seq`)})),W(`Len`,1,e=>_u(e,0,yu(``,`Len`)).length),W(`\\o`,2,e=>{let t=_u(e,0,bu(`s \\o t`,`sequence`));if(typeof t!=`string`){let n=gu(e,1,bu(`t \\o s`,`sequence`));return I([...t,...n])}let n=U(e,1,`\\o`);if(typeof n!=`string`)throw new p(`${bu(`t \\o s`,`string`)}\n${H(n)}`);return M(t+n)}),W(`Append`,2,e=>I([...gu(e,0,bu(`Append(s, v)`,`sequence`)),U(e,1,`Append`)])),W(`Head`,1,e=>{let t=gu(e,0,yu(``,`Head`));if(t.length===0)throw new p(`Attempted to apply Head to the empty sequence.`);return t[0]}),W(`Tail`,1,e=>{let t=_u(e,0,yu(``,`Tail`));if(t.length===0)throw new p(`Attempted to apply Tail to the empty sequence.`);return vu(t,1)}),W(`SubSeq`,3,e=>{let t=_u(e,0,yu(`first `,`SubSeq`)),n=Mn(e,1,`SubSeq`),r=Mn(e,2,`SubSeq`);if(n>r)return vu(t,0,0);let i=n<1?{position:`second`,value:n}:r>t.length?{position:`third`,value:r}:void 0;if(i)throw new p(`The ${i.position} argument of SubSeq must be in the domain of its first argument:\n${H(U(e,0,`SubSeq`))}\n, but instead it is\n${i.value}`);return vu(t,n-1,r)}),Hn(`SelectSeq`,2,e=>{let t=Bn(e,1,`SelectSeq`);return I(gu(e,0,yu(`first `,`SelectSeq`)).filter(e=>{let n=t.call([e]);if(typeof n!=`boolean`)throw new p(`The second argument of SelectSeq should be a operator, but instead it is:\n${H(n)}`);return n}))})]),Cu=xu(`FiniteSets`,[W(`IsFiniteSet`,1,e=>{let t=U(e,0,`IsFiniteSet`);if(O(t))return Gt(t);if(typeof t==`object`&&t.kind===`Function`)return!0;throw new f(typeof t==`object`&&t.kind===`LazyFunction`?`Attempted to check if the function:\n${H(t)}\nis a finite set.`:`Attempted to check if the ${me(t)} ${H(t)} is a finite set.`)}),W(`Cardinality`,1,e=>{let t=U(e,0,`Cardinality`);if(!O(t)||typeof t==`object`&&(t.kind===`InfiniteSet`||t.kind===`SequenceSet`))throw new p(`Attempted to compute cardinality of the value\n${H(t)}`);return Ut(t)})]),wu=/* @__PURE__ */ new Map([[`Integers`,[`Naturals`]],[`Sequences`,[`Naturals`]],[`FiniteSets`,[`Naturals`,`Sequences`]],[`TLC`,[`Naturals`,`Sequences`,`FiniteSets`]],[`Randomization`,[`Naturals`,`FiniteSets`,`Sequences`]],[`_Possible`,[`TLC`,`TLCExt`,`Naturals`,`Sequences`,`FiniteSets`,`Integers`]],[`Json`,[`Sequences`,`FiniteSets`,`TLC`,`Naturals`]],[`Bags`,[`Naturals`]],[`TLCExt`,[`TLC`,`Integers`,`Naturals`,`Sequences`,`FiniteSets`]]]),Tu=(e,t,n,r)=>{switch(e){case`Naturals`:return{extends:[],operators:mu};case`Integers`:return{extends:[`Naturals`],operators:hu};case`Sequences`:return{extends:[],operators:Su};case`FiniteSets`:return{extends:[],operators:Cu};case`TLC`:return{extends:[],operators:xu(`TLC`,Yl(t,n))};case`Randomization`:return{extends:[],operators:Dl(n)};case`_Possible`:return{extends:[],operators:Hl(t,n)};case`Json`:return{extends:[],operators:xl(r)};case`Bags`:return{extends:[],operators:el};case`TLCExt`:return{extends:[],operators:Vl(t,n)};default:return}},Eu=`$subexpression`,Du=(e,t)=>new u(`${e} at line ${t.line}, column ${t.column}`),Ou=e=>e.filter((t,n)=>n===0||e[n-1].set!==t.set).map(e=>e.set),ku=(e,t)=>typeof e==`number`?e>=1&&e<=t?e-1:-1:e===`<<`?t>0?0:-1:t===2?1:-1,Au=e=>{switch(e.kind){case`Apply`:return e.args;case`And`:case`Or`:return e.operands;case`If`:return[e.condition,e.consequent,e.alternative];case`Tuple`:case`SetEnumeration`:return e.elements;case`Record`:case`RecordSet`:return e.fields.map(e=>e.value);case`FunctionApplication`:return[e.function,e.args.length===1?e.args[0]:{kind:`Tuple`,elements:e.args,location:e.location}];case`FieldAccess`:return[e.record,{kind:`String`,value:e.field,location:e.location}];case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:return[e.expression];case`BoxAction`:case`AngleAction`:return[e.action,e.subscript];case`WeakFairness`:case`StrongFairness`:return[e.subscript,e.action];case`FunctionSet`:return[e.domain,e.range];case`Product`:return e.factors;case`Except`:return[e.function];default:return}},ju=e=>{switch(e.kind){case`Forall`:case`Exists`:case`FunctionConstruction`:return{names:kr(e.bounds),body:e.body,sets:Ou(e.bounds)};case`SetMap`:return{names:kr(e.bounds),body:e.expression,sets:Ou(e.bounds)};case`SetFilter`:return{names:Or(e.bound.pattern),body:e.predicate,sets:[e.bound.set]};case`Choose`:return{names:Or(e.pattern),body:e.body,sets:e.set?[e.set]:[]};case`UnboundedQuantifier`:case`Lambda`:return{names:e.kind===`Lambda`?e.params:e.names,body:e.body,sets:[]};default:return}},Mu=(e,t,n)=>{if(e.kind===`Label`)return e.name===t?{label:e,lets:n}:void 0;if(e.kind===`Let`)return Mu(e.body,t,[...n,e.definitions]);if(e.kind!==`Lambda`)for(let r of Ua(e)){let e=Mu(r,t,n);if(e)return e}},Nu=(e,t,n)=>e.length===0&&n.length>0?n.splice(0,t):e,Pu=(e,t,n)=>t.reduceRight((e,t)=>({kind:`Let`,definitions:t,body:e,location:n}),e),Fu=(e,t)=>{let n=e.location,r=Pu(t,e.lets,n);if(e.params.length===0)return r;if(e.args.length===0){if(e.params.some(e=>e.arity>0))throw Du(`Selected an operator with operator parameters as an argument`,n);return{kind:`Lambda`,params:e.params.map(e=>e.name),body:r,location:n}}if(e.args.length!==e.params.length)throw Du(`The subexpression requires ${e.params.length} arguments but received ${e.args.length}`,n);return{kind:`Let`,definitions:[{kind:`Operator`,name:Eu,params:e.params,body:r,isLocal:!0,isRecursive:!1,location:n}],body:{kind:`Apply`,operator:Eu,args:e.args,location:n,resolution:vr},location:n}},Iu=(e,t)=>{let n=t.location,r=e.kind===`Operator`?e.params.map((e,n)=>({name:`${e.name}$${t.params.length+n}`,arity:e.arity})):[],i=r.map(e=>({kind:`Identifier`,name:e.name,location:n,resolution:vr})),a=i.length===0?{kind:`Identifier`,name:e.name,location:n,resolution:vr}:{kind:`Apply`,operator:e.name,args:i,location:n,resolution:vr};return Fu({...t,params:[...t.params,...r]},a)},Lu=(e,t,n,r)=>{let i={params:[],args:[],lets:[],location:n},a={index:0,current:void 0},o=i=>{let o=[],s=[];for(;a.index<e.length;){let c=e[a.index];if(c.kind!==`Name`)throw Du(`Expected an operator name`,n);o.push(c.name),s.push(...c.args);let l=o.join(`!`),u=i?i.find(e=>di(e)===l):t(l);if(u)return{definition:u,args:Nu(s,Cr(u),r)};a.index++}throw Du(`Unknown operator ${o.join(`!`)}`,n)},s=t=>{let r=o(t),s=r.definition,c=Cr(s),l=a.index===e.length-1;if(r.args.length!==c&&r.args.length!==0)throw Du(`The operator ${s.name} requires ${c} arguments`,n);if(l)return{definition:s,args:r.args};if(s.kind!==`Operator`)throw Du(`Cannot select a subexpression of ${s.name}`,n);i.params.push(...s.params),i.args.push(...r.args),a.current=s.body,a.index++},c=()=>{for(;a.index<e.length;){let t=e[a.index];if(t.kind!==`Name`)return;let o=a.current&&Mu(a.current,t.name,[]);if(!o)throw Du(`Cannot find label ${t.name}`,n);i.lets.push(...o.lets),i.params.push(...o.label.params.map(e=>({name:e,arity:0}))),i.args.push(...Nu(t.args,o.label.params.length,r)),a.current=o.label.body,a.index++}},l=t=>{let o=a.current;if(!o)throw Du(`Subexpression selection failed`,n);if(t.kind===`Colon`)return;if(o.kind===`Label`){a.current=o.body,l(t);return}if(o.kind===`Let`){if(t.kind!==`Operand`||ku(t.operand,1)!==0)throw Du(`A LET/IN expression has only one operand`,n);i.lets.push(o.definitions),a.current=o.body;return}let s=ju(o);if(s&&(t.kind===`Bound`||t.kind===`At`)){i.params.push(...s.names.map(e=>({name:e,arity:0}))),t.kind===`Bound`&&i.args.push(...Nu(t.args,s.names.length,r)),a.current=s.body;return}if(o.kind===`Case`&&t.kind===`Operand`){let r=[...o.arms,...o.other?[{condition:void 0,body:o.other}]:[]],i=r[ku(t.operand,r.length)],s=e[a.index+1];if(!i||s?.kind!==`Operand`)throw Du(`A subexpression of CASE must have the form !i!j`,n);a.index++;let c=ku(s.operand,2),l=c===0?i.condition:c===1?i.body:void 0;if(!l)throw Du(`Nonexistent CASE operand`,n);a.current=l;return}if(t.kind!==`Operand`)throw Du(`Unexpected subexpression selector`,n);let c=s?s.sets:Au(o),u=c?.[ku(t.operand,c.length)];if(!u)throw Du(`Nonexistent operand specified by the selector`,n);a.current=u},u=s(void 0);if(u)return Iu(u.definition,{...i,args:u.args});for(c();a.index<e.length;){let t=e[a.index];if(t.kind===`Name`){for(;a.current?.kind===`Label`;)a.current=a.current.body;if(a.current?.kind!==`Let`)throw Du(`A name selector here must be from a LET clause`,n);i.lets.push(a.current.definitions);let e=s(a.current.definitions);if(e)return Iu(e.definition,{...i,args:[...i.args,...e.args]});c()}else l(t),a.index++}if(!a.current)throw Du(`Subexpression selection failed`,n);return Fu(i,a.current)},Ru=(e,t)=>{if(!e.includes(`!`)||t(e))return;let n=e.split(`!`),r=n.findIndex((e,r)=>t(n.slice(0,r+1).join(`!`)));if(r!==-1)return[{kind:`Name`,name:n.slice(0,r+1).join(`!`),args:[]},...n.slice(r+1).map(e=>({kind:`Name`,name:e,args:[]}))]},zu=e=>e.kind===`Subexpression`||e.kind===`Identifier`&&e.name.includes(`!`)||e.kind===`Apply`&&e.operator.includes(`!`)||Ua(e).some(zu),Bu=(e,t)=>{if(!zu(e))return e;if(e.kind===`Let`){let n=n=>e.definitions.find(e=>e.name===n)??t(n);return mi(e,e=>Bu(e,n))}let n=mi(e,e=>Bu(e,t));if(n.kind===`Subexpression`)return Lu(n.selectors,t,n.location,[]);let r=n.kind===`Identifier`?n.name:n.kind===`Apply`?n.operator:``,i=Ru(r,t);if(!i)return n;let a=n.kind===`Apply`?[...n.args]:[],o=Lu(i,t,n.location,a);if(a.length>0)throw Du(`Too many arguments for ${r}`,n.location);return o},Vu=e=>{let t=new Map(e.map(e=>[e.name,e]));return e=>t.get(e)},Hu=(e,t)=>{let n=Vu(t.definitions);return{...e,substitutions:e.substitutions.map(e=>({name:e.name,expression:Bu(e.expression,n)}))}},Uu=(e,t)=>{let n=Vu([...t,...e.definitions]);return e.definitions.some(e=>zu(e.body))||e.assumptions.some(e=>zu(e.expression))?{...e,definitions:e.definitions.map(e=>pi(e,e=>Bu(e,n))),assumptions:e.assumptions.map(e=>({...e,expression:Bu(e.expression,n)}))}:e},Wu=new Map([[`Nat`,0,[],[],[]],[`+`,0,[0,0],[2,2],[1,1]],[`-`,0,[0,0],[2,2],[1,1]],[`*`,0,[0,0],[3,3],[0,0]],[`^`,0,[0,0],[2,2],[1,1]],[`<`,0,[0,0],[2,2],[1,1]],[`>`,0,[0,0],[2,2],[1,1]],[`<=`,0,[0,0],[2,2],[1,1]],[`>=`,0,[0,0],[2,2],[1,1]],[`%`,0,[0,0],[2,2],[1,1]],[`\\div`,0,[0,0],[2,2],[1,1]],[`..`,0,[0,0],[2,2],[1,1]],[`Int`,0,[],[],[]],[`-.`,0,[0],[2],[1]],[`Seq`,0,[0],[2],[1]],[`Len`,0,[0],[2],[1]],[`\\o`,0,[0,0],[2,2],[1,1]],[`Append`,0,[0,0],[2,2],[1,1]],[`Head`,0,[0],[2],[1]],[`Tail`,0,[0],[2],[1]],[`SubSeq`,0,[0,0,0],[2,2,2],[1,1,1]],[`SelectSeq`,0,[0,1],[2,2],[1,1],[],[`1, 0, 0`]],[`IsFiniteSet`,0,[0],[2],[1]],[`Cardinality`,0,[0],[2],[1]],[`IsABag`,0,[0],[2],[1]],[`BagToSet`,0,[0],[2],[1]],[`SetToBag`,0,[0],[3],[1]],[`BagIn`,0,[0,0],[2,2],[1,1]],[`EmptyBag`,0,[],[],[]],[`\\oplus`,0,[0,0],[2,2],[1,1]],[`\\ominus`,0,[0,0],[2,2],[1,1]],[`BagUnion`,0,[0],[2],[1]],[`\\sqsubseteq`,0,[0,0],[2,2],[1,1]],[`SubBag`,0,[0],[2],[1]],[`BagOfAll`,0,[1,0],[2,2],[1,1]],[`BagCardinality`,0,[0],[2],[1]],[`CopiesIn`,0,[0,0],[2,2],[1,1]],[`Print`,0,[0,0],[3,3],[0,1]],[`PrintT`,0,[0],[3],[0]],[`Assert`,0,[0,0],[2,3],[1,0]],[`JavaTime`,0,[],[],[]],[`TLCGet`,0,[0],[3],[0]],[`TLCSet`,0,[0,0],[3,3],[0,0]],[`:>`,0,[0,0],[2,3],[1,1]],[`@@`,0,[0,0],[2,2],[1,1]],[`Permutations`,0,[0],[2],[1]],[`SortSeq`,0,[0,2],[2,2],[1,1],[],[`1, 0, 0`,`1, 0, 1`]],[`RandomElement`,0,[0],[3],[1]],[`Any`,0,[],[],[]],[`ToString`,0,[0],[2],[1]],[`TLCEval`,0,[0],[3],[1]],[`AssertEq`,0,[0,0],[2,2],[1,1]],[`AssertError`,0,[0,0],[2,3],[1,0]],[`TLCGetOrDefault`,0,[0,0],[3,3],[0,0]],[`TLCGetAndSet`,0,[0,2,0,0],[3,3,3,3],[0,0,0,0],[],[`1, 2, 1`]],[`Trace`,0,[],[],[]],[`CounterExample`,0,[],[],[]],[`ToTrace`,0,[0],[3],[0]],[`TLCModelValue`,0,[0],[2],[1]],[`TLCDefer`,0,[0],[3],[0]],[`TLCNoOp`,0,[0],[3],[1]],[`PickSuccessor`,0,[0],[3],[1]],[`TLCCache`,0,[0,0],[3,3],[1,0]],[`TLCFP`,0,[0],[3],[0]],[`TLCEvalDefinition`,0,[0],[3],[0]],[`ToJson`,0,[0],[2],[1]],[`ToJsonArray`,0,[0],[2],[1]],[`ToJsonObject`,0,[0],[2],[1]],[`JsonSerialize`,0,[0,0],[3,3],[0,0]],[`JsonDeserialize`,0,[0],[3],[0]],[`ndJsonSerialize`,0,[0,0],[3,3],[0,0]],[`ndJsonDeserialize`,0,[0],[3],[0]],[`RandomSubset`,0,[0,0],[2,2],[1,1]],[`RandomSetOfSubsets`,0,[0,0,0],[2,3,2],[1,0,1]],[`TestRandomSetOfSubsets`,0,[0,0,0],[2,3,2],[1,0,1]]].map(e=>[e[0],{name:e[0],level:e[1],params:/* @__PURE__ */ new Set,constraints:/* @__PURE__ */ new Map,argConstraints:/* @__PURE__ */ new Map,argParams:/* @__PURE__ */ new Set,formals:e[2].map((e,t)=>({name:`$${t}`,arity:e})),maxLevels:e[3],weights:e[4],minMaxLevels:e[5]??[],conditions:new Set(e[6]),nonLeibniz:/* @__PURE__ */ new Set}])),Gu=(e,t)=>`${e}${t}`,Ku=(e,t,n)=>`${e}${t}${n}`,qu=e=>{let t=e.split(`\0`);return{operator:t[0],index:Number(t[1]),param:t[2]}},Ju=(e,t,n)=>`${e},${t},${n}`,Yu=(e=0)=>({level:e,params:/* @__PURE__ */ new Set,constraints:/* @__PURE__ */ new Map,argConstraints:/* @__PURE__ */ new Map,argParams:/* @__PURE__ */ new Set}),Xu=(e,t,n)=>e.set(t,Math.min(n,e.get(t)??3)),Zu=(e,t,n)=>e.set(t,Math.max(n,e.get(t)??0)),Qu=(e,t,n,r)=>({...Yu(t),name:e,formals:[],maxLevels:n,weights:r,minMaxLevels:[],conditions:/* @__PURE__ */ new Set,nonLeibniz:/* @__PURE__ */ new Set}),$u=(e,t)=>e.formals.length===0&&e.maxLevels.length>0?e.maxLevels[Math.min(t,e.maxLevels.length-1)]:e.maxLevels[t]??3,ed=(e,t)=>e.formals.length===0&&e.weights.length>0?e.weights[Math.min(t,e.weights.length-1)]:e.weights[t]??1,td=new Map([[`=`,0,[2,2],[1,1]],[`#`,0,[2,2],[1,1]],[`\\in`,0,[2,2],[1,1]],[`\\notin`,0,[2,2],[1,1]],[`\\subseteq`,0,[2,2],[1,1]],[`\\cup`,0,[2,2],[1,1]],[`\\cap`,0,[2,2],[1,1]],[`\\`,0,[2,2],[1,1]],[`=>`,0,[3,3],[1,1]],[`<=>`,0,[3,3],[1,1]],[`/\\`,0,[3,3],[1,1]],[`\\/`,0,[3,3],[1,1]],[`~`,0,[3],[1]],[`SUBSET`,0,[2],[1]],[`UNION`,0,[2],[1]],[`DOMAIN`,0,[2],[1]],[`~>`,3,[3,3],[0,0]],[`-+->`,3,[3,3],[0,0]],[`\\cdot`,2,[2,2],[0,0]],[`TRUE`,0,[],[]],[`FALSE`,0,[],[]],[`BOOLEAN`,0,[],[]],[`STRING`,0,[],[]]].map(([e,t,n,r])=>[e,{...Qu(e,t,[...n],[...r]),nonLeibniz:new Set(t>1?[0,1]:[])}])),nd=Qu(`$Set`,0,[2],[1]),rd=Qu(`$Junction`,0,[3],[1]),id=Qu(`$Choose`,0,[2],[1]),ad=Qu(`$Function`,0,[3],[1]),od=Qu(`$FcnApply`,0,[2,2],[1,1]),sd=Qu(`$RcdSelect`,0,[2,0],[1,1]),cd=Qu(`'`,2,[1],[0]),ld=Qu(`ENABLED`,1,[2],[0]),ud=Qu(`[]`,3,[3],[0]),dd=Qu(`$SquareAct`,2,[2,1],[0,0]),fd=Qu(`$WF`,3,[1,2],[0,0]),pd=Qu(`$TemporalExists`,3,[3],[0]),md=(e,t)=>t.length===0?e:new Map([...e,...t.map(e=>[e.name,{kind:`Formal`,arity:e.arity}])]),hd=e=>e.map(e=>({name:e,arity:0})),gd=(e,t)=>new u(`${e} at line ${t.line}, column ${t.column}`),_d=/* @__PURE__ */ new Set([`/\\`,`\\/`,`=>`,`<=>`]),vd=e=>e.kind!==`Let`&&e.kind!==`Label`,yd=e=>{let t=/* @__PURE__ */ new Map,n=(t,n)=>{let r=n.get(t);if(r?.kind===`Formal`)return{kind:`Declared`,name:t,level:0,arity:r.arity};if(r?.kind===`Let`)return{kind:`Defined`,levels:_(r.definition,r.scope)};if(e.constants.has(t))return{kind:`Declared`,name:t,level:0,arity:0};if(e.variables.has(t))return{kind:`Declared`,name:t,level:1,arity:0};let i=e.getDefinition(t);if(i)return{kind:`Defined`,levels:_(i,/* @__PURE__ */ new Map)};let a=td.get(t)??Wu.get(t);return a?{kind:`Defined`,levels:a}:{kind:`Declared`,name:t,level:0,arity:0}},r=(e,t,n)=>{let r=Yu(Math.max(t,...n.map(e=>e.data.level)));return r.params.add(e),n.forEach((t,n)=>{t.data.params.forEach(t=>{r.params.add(t),r.argParams.add(Ku(e,n,t))}),t.data.constraints.forEach((e,t)=>Xu(r.constraints,t,e)),Zu(r.argConstraints,Gu(e,n),t.data.level),t.data.argConstraints.forEach((e,t)=>Zu(r.argConstraints,t,e)),t.data.argParams.forEach(e=>r.argParams.add(e))}),r},i=(e,t,n=[],r=[])=>{let i=e=>r.includes(e);if(t.forEach((t,n)=>{if(!(t.operator||t.declared)&&t.data.level>$u(e,n))throw new u(`Level error in applying operator ${e.name}: The level of argument ${n+1} exceeds the maximum level allowed by the operator.`)}),n.some(e=>e.level>2))throw new u(`Level error in applying operator ${e.name}: The level of the range for a bounded variable exceeds the maximum level allowed by the operator.`);let a=n=>{let r=e.formals.findIndex(e=>e.name===n);return r===-1?void 0:t[r]},o=(t,n,r)=>e.conditions.has(Ju(t,n,r)),s=Yu(Math.max(e.level,...t.filter((t,n)=>ed(e,n)===1).map(e=>e.data.level),...n.map(e=>e.level)));return e.params.forEach(e=>s.params.add(e)),t.forEach((t,n)=>{ed(e,n)===1&&t.data.params.forEach(e=>s.params.add(e))}),n.forEach(e=>e.params.forEach(e=>s.params.add(e))),r.forEach(e=>s.params.delete(e)),e.constraints.forEach((e,t)=>Xu(s.constraints,t,e)),t.forEach(e=>e.data.constraints.forEach((e,t)=>{i(t)||Xu(s.constraints,t,e)})),n.forEach(e=>e.constraints.forEach((e,t)=>Xu(s.constraints,t,e))),t.forEach((t,n)=>t.data.params.forEach(t=>{i(t)||Xu(s.constraints,t,$u(e,n))})),t.forEach((e,n)=>{let r=e.operator;r&&t.forEach((e,t)=>r.formals.forEach((i,a)=>{o(n,t,a)&&e.data.params.forEach(e=>Xu(s.constraints,e,$u(r,a)))}))}),e.argParams.forEach(e=>{let t=qu(e),n=a(t.operator)?.operator;n&&Xu(s.constraints,t.param,$u(n,t.index))}),[e.argConstraints,...t.map(e=>e.data.argConstraints),...n.map(e=>e.argConstraints)].forEach(e=>e.forEach((e,t)=>Zu(s.argConstraints,t,e))),t.forEach((n,r)=>{let i=n.declared;i&&(Array.from({length:i.arity},(t,n)=>Zu(s.argConstraints,Gu(i.name,n),e.minMaxLevels[r]?.[n]??0)),t.forEach((e,t)=>Array.from({length:i.arity},(n,a)=>{o(r,t,a)&&Zu(s.argConstraints,Gu(i.name,a),e.data.level)})))}),e.argParams.forEach(e=>{let t=qu(e),n=a(t.operator);n&&Zu(s.argConstraints,Gu(t.operator,t.index),n.data.level)}),t.forEach(e=>e.data.argParams.forEach(e=>{i(qu(e).param)||s.argParams.add(e)})),n.forEach(e=>e.argParams.forEach(e=>s.argParams.add(e))),e.argParams.forEach(e=>{let t=qu(e),n=a(t.operator);if(n)n.declared&&s.argParams.add(Ku(n.declared.name,t.index,t.param));else{let n=a(t.param);if(!n){s.argParams.add(e);return}n.data.params.forEach(e=>s.argParams.add(Ku(t.operator,t.index,e)))}}),t.forEach((e,n)=>{let r=e.declared;r&&t.forEach((e,t)=>Array.from({length:r.arity},(i,a)=>{o(n,t,a)&&e.data.params.forEach(e=>s.argParams.add(Ku(r.name,a,e)))}))}),s},a=(e,t)=>{if(e.kind===`Lambda`){let n=g(`LAMBDA`,hd(e.params),e.body,t);return{data:n,operator:n}}let r=e.kind===`OperatorReference`?e.operator:e.kind===`Identifier`?e.name:void 0;if(r!==void 0){let i=n(r,t);if(i.kind===`Defined`&&(i.levels.formals.length>0||e.kind===`OperatorReference`))return{data:i.levels,operator:i.levels};if(i.kind===`Declared`&&i.arity>0){let e=Yu();return e.params.add(r),{data:e,declared:{name:r,arity:i.arity}}}}return{data:m(e,t)}},o=(e,t)=>e.map(e=>a(e,t)),s=(e,t,n,r=[],a=[])=>{let s=md(n,hd(a));return i(e,o(t,s),r.map(e=>m(e,n)),a)},c=(e,t)=>e.kind===`Declared`?r(e.name,e.level,t):i(e.levels,t),l=(e,t)=>{let n=e.map(e=>e.data.level);if(n.includes(2)&&n.includes(3))throw gd(`Formula has both temporal formula and action as arguments`,t)},d=(e,t)=>{if((e.operator===`~>`||e.operator===`-+->`)&&t.some(e=>e.data.level===2))throw gd(`Action used where only temporal formula or state predicate allowed`,e.location);_d.has(e.operator)&&l(t,e.location)},f=(e,t)=>{let n=e.expression,r=e.kind===`Always`?`BoxAction`:`AngleAction`;if(t===2&&vd(n)&&n.kind!==r)throw gd(e.kind===`Always`?`[] followed by action not of form [A]_v`:`<> followed by action not of form <<A>>_v`,e.location)},p=(e,t)=>{let n=new Map(t);e.definitions.forEach(e=>n.set(e.name,{kind:`Let`,definition:e,scope:n}));let r=m(e.body,n),i={level:r.level,params:new Set(r.params),constraints:new Map(r.constraints),argConstraints:new Map(r.argConstraints),argParams:new Set(r.argParams)};return e.definitions.forEach(e=>{let t=_(e,n);t.constraints.forEach((e,t)=>Xu(i.constraints,t,e)),t.argConstraints.forEach((e,t)=>Zu(i.argConstraints,t,e)),t.argParams.forEach(e=>i.argParams.add(e))}),i},m=(e,t)=>{switch(e.kind){case`Number`:case`Decimal`:case`String`:case`ExceptAt`:return Yu();case`Identifier`:return c(n(e.name,t),[]);case`Apply`:{let r=o(e.args,t);return d(e,r),c(n(e.operator,t),r)}case`OperatorReference`:case`Lambda`:return a(e,t).data;case`And`:case`Or`:{let n=o(e.operands,t);return l(n,e.location),i(rd,n)}case`Prime`:case`Unchanged`:return s(cd,[e.expression],t);case`Enabled`:return s(ld,[e.expression],t);case`Always`:case`Eventually`:{let n=a(e.expression,t);return f(e,n.data.level),i(ud,[n])}case`If`:return s(rd,[e.condition,e.consequent,e.alternative],t);case`Case`:return s(rd,[...e.arms.flatMap(e=>[e.condition,e.body]),...e.other?[e.other]:[]],t);case`Let`:return p(e,t);case`Forall`:case`Exists`:{let n=s(rd,[e.body],t,e.bounds.map(e=>e.set),kr(e.bounds));if(n.level===3&&e.bounds.some(e=>m(e.set,t).level===2))throw gd(`Action-level bound of quantified temporal formula`,e.location);return n}case`UnboundedQuantifier`:return s(e.isTemporal?pd:rd,[e.body],t,[],e.names);case`Choose`:return s(id,[e.body],t,e.set?[e.set]:[],Or(e.pattern));case`SetEnumeration`:case`Tuple`:case`FunctionSet`:case`Product`:return s(nd,e.kind===`FunctionSet`?[e.domain,e.range]:e.kind===`Product`?e.factors:e.elements,t);case`SetFilter`:return s(nd,[e.predicate],t,[e.bound.set],Or(e.bound.pattern));case`SetMap`:return s(nd,[e.expression],t,e.bounds.map(e=>e.set),kr(e.bounds));case`FunctionConstruction`:return s(ad,[e.body],t,e.bounds.map(e=>e.set),kr(e.bounds));case`Record`:return s(ad,e.fields.map(e=>e.value),t);case`RecordSet`:return s(nd,e.fields.map(e=>e.value),t);case`Except`:return s(nd,[e.function,...e.updates.flatMap(e=>[...e.path.flatMap(e=>e.kind===`Index`?e.args:[]),e.value])],t);case`FunctionApplication`:return i(od,[a(e.function,t),e.args.length===1?a(e.args[0],t):{data:s(nd,e.args,t)}]);case`FieldAccess`:return i(sd,[a(e.record,t),{data:Yu()}]);case`BoxAction`:case`AngleAction`:return s(dd,[e.action,e.subscript],t);case`WeakFairness`:case`StrongFairness`:return s(fd,[e.subscript,e.action],t);case`Label`:return m(e.body,t);case`Subexpression`:return Yu()}},h=(e,t,r=!1,i=/* @__PURE__ */ new Set)=>{let a=(e,n=r,a=t)=>h(e,a,n,i),o=(e,o)=>{let s=n(e,t);s.kind===`Declared`?(r&&i.add(e),o.forEach(e=>a(e))):o.forEach((e,t)=>a(e,r||s.levels.nonLeibniz.has(t)))};switch(e.kind){case`Identifier`:return o(e.name,[]),i;case`Apply`:return o(e.operator,e.args),i;case`Lambda`:case`Let`:return i;case`Prime`:case`Unchanged`:case`Enabled`:case`Always`:case`Eventually`:case`BoxAction`:case`AngleAction`:case`WeakFairness`:case`StrongFairness`:return Ua(e).forEach(e=>a(e,!0)),i;case`UnboundedQuantifier`:return a(e.body,r||e.isTemporal===!0,md(t,hd(e.names))),i;default:return mi(e,(e,n)=>(a(e,r,md(t,hd(n))),e)),i}},g=(e,t,n,r)=>{let i=md(r,t),a=m(n,i),o=e=>t.some(t=>t.name===e),s=h(n,i),c={...Yu(a.level),name:e,formals:t,nonLeibniz:new Set(t.flatMap((e,t)=>s.has(e.name)?[t]:[])),maxLevels:t.map(e=>Math.min(3,a.constraints.get(e.name)??3)),weights:t.map(e=>+!!a.params.has(e.name)),minMaxLevels:t.map(e=>Array.from({length:e.arity},(t,n)=>a.argConstraints.get(Gu(e.name,n))??0)),conditions:new Set(t.flatMap((e,n)=>t.flatMap((t,r)=>Array.from({length:e.arity},(e,t)=>t).filter(n=>a.argParams.has(Ku(e.name,n,t.name))).map(e=>Ju(n,r,e)))))};return a.params.forEach(e=>{o(e)||c.params.add(e)}),a.constraints.forEach((e,t)=>{o(t)||c.constraints.set(t,e)}),a.argConstraints.forEach((e,t)=>{o(qu(t).operator)||c.argConstraints.set(t,e)}),a.argParams.forEach(e=>{let t=qu(e);o(t.operator)&&o(t.param)||c.argParams.add(e)}),c},_=(e,n)=>{let r=t.get(e);if(r)return r;let i=e.kind===`Operator`?e.params:[];t.set(e,{...Yu(),name:e.name,formals:i,maxLevels:i.map(()=>3),weights:i.map(()=>0),minMaxLevels:i.map(()=>[]),conditions:/* @__PURE__ */ new Set,nonLeibniz:/* @__PURE__ */ new Set});let a=e.kind===`Function`?{kind:`FunctionConstruction`,bounds:e.bounds,body:e.body,location:e.location}:e.body,o=g(e.name,i,a,n);return t.set(e,o),o};return{analyze:m,analyzeDefinition:_,toOperand:a}},bd=(e,t,n)=>{let r=new Map(t);e.assumptions.forEach(e=>{e.kind===`NewSymbol`?(e.set&&n.analyze(e.set,r),r.set(e.name,{kind:`Formal`,arity:e.arity})):e.kind===`AssumeProve`?bd(e,r,n):n.analyze(e,r)}),n.analyze(e.conclusion,r)},xd=(e,t)=>{let n=yd(t);e.definitions.filter(e=>!e.name.includes(`!`)).forEach(e=>n.analyzeDefinition(e,/* @__PURE__ */ new Map)),e.assumptions.forEach(e=>n.analyze(e.expression,/* @__PURE__ */ new Map)),e.theorems.forEach(e=>e.statement.kind===`AssumeProve`?bd(e.statement,/* @__PURE__ */ new Map,n):n.analyze(e.statement,/* @__PURE__ */ new Map))},Sd=(e,t)=>e.maxLevels[t]??3,Cd=(e,t)=>{let n=/* @__PURE__ */ new Map,r=e=>{let r=n.get(e);if(r)return r;let i=t(e),a=yd({constants:new Set(i.constants.map(e=>e.name)),variables:new Set(i.variables),getDefinition:i.getDefinition});return n.set(e,a),a},i=/* @__PURE__ */ new Map,a=e=>{let n=i.get(e);if(n)return n;let a=t(e),o=r(e),s=a.definitions.map(e=>o.analyzeDefinition(e,/* @__PURE__ */ new Map)),c={isConstant:a.variables.length===0&&s.every(e=>e.level===0),constraints:/* @__PURE__ */ new Map,argConstraints:/* @__PURE__ */ new Map,argParams:/* @__PURE__ */ new Set};c.isConstant||a.constants.forEach(e=>Xu(c.constraints,e.name,0));let l=(e,t)=>{e.constraints.forEach((e,t)=>Xu(c.constraints,t,e)),e.argConstraints.forEach((e,t)=>Zu(c.argConstraints,t,e)),e.argParams.forEach(e=>{let n=qu(e);t(n.operator,n.param)&&c.argParams.add(e)})};return s.forEach(e=>l(e,(t,n)=>e.formals.every(e=>e.name!==t&&e.name!==n))),a.assumptions.forEach(e=>l(o.analyze(e,/* @__PURE__ */ new Map),()=>!0)),i.set(e,c),c},o=/* @__PURE__ */ new Set;if(e.forEach(e=>{let n=`at line ${e.location.line}, column ${e.location.column}`,i=e=>o.add(`${e} ${n}`),s=t(e.module),c=a(e.module),l=r(e.instancer),u=/* @__PURE__ */ new Map;e.lets.forEach(e=>u.set(e.name,{kind:`Let`,definition:e,scope:u}));let d=[...s.constants.map(e=>({...e,maximumLevel:0})),...s.variables.map(e=>({name:e,arity:0,maximumLevel:1}))].flatMap(t=>{let n=e.substitutions.get(t.name);if(!n)return[];if(t.arity===0){let e=l.analyze(n,u);return[{...t,level:e.level,operator:void 0,isLeibniz:!0}]}let r=l.toOperand(n,u);return[{...t,level:r.data.level,operator:r.operator,isLeibniz:r.operator===void 0||r.operator.nonLeibniz.size===0}]}),f=(t,n)=>`Level error in instantiating module '${e.module}': the level of the expression or operator substituted for '${t}' must be at most ${n}`;d.forEach(t=>{!c.isConstant&&t.level>t.maximumLevel&&i(f(t.name,t.maximumLevel)),t.isLeibniz||i(`Error in instantiating module '${e.module}': a non-Leibniz operator substituted for '${t.name}'`)}),d.forEach(t=>{let n=c.constraints.get(t.name);n!==void 0&&t.level>n&&i(f(t.name,n));let r=t.operator;r&&Array.from({length:t.arity},(n,a)=>{let o=c.argConstraints.get(Gu(t.name,a));o!==void 0&&Sd(r,a)<o&&i(`Level error in instantiating module '${e.module}': the level of the argument ${a+1} of the operator ${r.name} must be at least ${o}`)})}),c.argParams.forEach(t=>{let n=qu(t),r=d.find(e=>e.name===n.operator)?.operator,a=d.find(e=>e.name===n.param);if(!r||!a)return;let o=Sd(r,n.index);a.level>o&&i(`Level error when instantiating module '${e.module}': the level of the argument ${n.index} of the operator ${n.operator}' must be at most ${o}`)})}),o.size>0)throw new u([...o].join(`
+`))},wd=t=>{switch(t.kind){case`Number`:try{return he(t.value)}catch(t){throw a(t,e.error)}case`String`:case`Boolean`:return t.value;case`ModelValue`:return Ie(t.name);case`Set`:return pt(t.elements.map(wd))}},Td=e=>[...e.constants,...e.variables.map(e=>({name:e,arity:0}))],Ed=e=>new u(`Multiply-defined module '${e.name}' at line ${e.location.line}, column ${e.location.column}`),Dd=(e,t)=>({kind:`Operator`,name:t,params:[],body:{kind:`Let`,definitions:[e],body:{kind:`Identifier`,name:e.name,location:e.location,resolution:vr},location:e.location},isLocal:!0,isRecursive:!1,location:e.location}),Od=(e,t,n)=>{let r=`{ ${n.map(e=>`<${[...e[0],e[1]].map(e=>H(e)).join(`, `)}>`).join(`, `)}}`;return{kind:`Builtin`,name:e,arity:t,evaluate:e=>{let t=n.find(t=>{if(t[0].length!==e.length)throw new f(`Attempted to apply the operator ${r}\nwith wrong number of arguments.`);return t[0].every((t,n)=>{let r=e[n];return(typeof r!=`object`||r.kind!==`Operator`)&&Re(t,r)})});if(t)return t[1];throw new f(`Attempted to apply operator:\n${r}\nto arguments (${e.map(e=>typeof e==`object`&&e.kind===`Operator`?e.name:H(e)).join(`, `)}), which is undefined.`)},evaluateUnary:void 0,evaluateBinary:void 0}},kd=(e,t)=>e.kind===`Identifier`&&t.has(e.name)||e.kind===`Apply`&&t.has(e.operator)||Ua(e).some(e=>kd(e,t)),Ad=(e,t)=>{let n=new Map(e.map((e,t)=>[e,t]));return new Set(t).forEach(e=>n.set(Ci(e),n.get(e)??n.size)),n},jd=e=>e.flatMap(e=>e.substitutions.map(e=>e.expression)),Md=e=>e.forEach(e=>{if(e.kind===`Decimal`)throw Ia(e);if(e.kind===`Number`&&!Do(e.value))throw La(e);Md(e.kind===`Let`?[...Ua(e),...jd(e.instances??[])]:Ua(e))}),Nd=(e,t)=>{let n=Zs(t.source),r=/* @__PURE__ */ new Map,i=/* @__PURE__ */ new Map,a=new Map(du.map(e=>[e.name,e])),o=/* @__PURE__ */ new Map,s=jc(e.checkDeadlock,t.seed),c=/* @__PURE__ */ new Map,l=/* @__PURE__ */ new Map,f=[],p=/* @__PURE__ */ new Map,m=[],h=[],g=(e,t)=>m.forEach(n=>{n.add(e),[...t].forEach(e=>n.add(e))}),_={value:0},v=e=>`${e}#${_.value++}`,y=[],b=/* @__PURE__ */ new Map,x=e=>{let n=o.get(e);if(n)return n;let r=Tu(e,t.print,s,t.files);if(!r)return;let i=/* @__PURE__ */ new Map;return r.extends.forEach(e=>x(e)?.forEach((e,t)=>i.set(t,e))),r.operators.forEach(e=>{a.set(e.name,e),i.set(e.name,{key:e.name,arity:e.arity})}),o.set(e,i),i},S=e=>{let t=x(e);return t&&g(e,wu.get(e)??[]),t},ee=e=>(Md([...e.definitions.flatMap(e=>e.kind===`Function`?[...e.bounds.map(e=>e.set),e.body]:[e.body]),...e.assumptions.map(e=>e.expression),...e.theorems.flatMap(e=>e.statement.kind===`AssumeProve`?[]:[e.statement]),...jd(e.instances)]),e.modules.forEach(ee),e);ee(n);let C=(e,n)=>{let r=t.loadModule?.(e)??xs.get(e)??Xs(t.source,e);if(r===void 0)throw new u(`Cannot find source file for module ${e} imported in module ${n}.`);let i=Zs(r);if(i.name!==e)throw new u(`File name '${e}' does not match the name '${i.name}' of the top level module it contains.`);return ee(i)},w=e=>{let t=h.indexOf(e.name);if(t!==-1)throw new u(`Circular dependency among .tla files; dependency cycle is: ${[...h.slice(t),e.name].map(e=>`${e}.tla`).join(` --> `)}`);let n=/* @__PURE__ */ new Set,r=[];h.push(e.name),m.push(n);let i=oe(e,{id:e.name,symbols:/* @__PURE__ */ new Map,modules:/* @__PURE__ */ new Map,nested:r});m.pop(),h.pop();let a=r.find(e=>n.has(e.name));if(a)throw Ed(a);return{linked:i,closure:n}},T=(e,t)=>{let n=c.get(e);if(n)return g(e,p.get(e)??[]),n;let r=w(C(e,t));return c.set(e,r.linked),p.set(e,r.closure),g(e,r.closure),r.linked},te=(e,t,n,a,o)=>{let s=o?void 0:S(e.module);if(s)return e.name===void 0?s:new Map([...s].map(([t,n])=>[`${e.name}!${t}`,n]));let c=o??T(e.module,t.name),l=Td(c),u=`#${_.value++}`,d=new Map(e.params.map(e=>[e.name,`${e.name}${u}`])),f=ii(Hu(e,t),l,t,n);y.push({module:e.module,instancer:t.name,lets:[],substitutions:f,location:e.location});let p=Fi({params:e.params.map(e=>({...e,name:`${e.name}${u}`})),substitutions:new Map([...f].map(([e,t])=>[e,ci(t,d)])),variables:new Set(c.variables),getDefinition:e=>r.get(e),isParameterized:e=>i.get(e)===!0,addDefinition:(e,n)=>{let o=v(`${e}@${t.name}`);return r.set(o,n(o)),i.set(o,!a),o},createName:v}),m=new Set(l.map(e=>e.name)),h=/* @__PURE__ */ new Map;return c.exported.forEach((t,n)=>{if(m.has(n))return;if(e.name===void 0){let r=p.getKey(t.key);l.length>0&&b.set(r,{name:n,location:e.location}),h.set(n,{key:r,arity:t.arity});return}let r=p.getQualifiedKey(t.key);l.length>0&&b.set(r,{name:`${e.name}!${n}`,location:e.location}),h.set(`${e.name}!${n}`,{key:r,arity:t.arity+e.params.length})}),h},E=(e,t)=>e.map(e=>({kind:`Identifier`,name:e.name,location:t,resolution:vr})),ne=(e,t,n,r,i)=>({kind:`Operator`,name:e,params:n,body:r.length===0?{kind:`Identifier`,name:t,location:i}:{kind:`Apply`,operator:t,args:E(r,i),location:i},isLocal:!0,isRecursive:!1,location:i}),re=e=>Array.from({length:e},(e,t)=>({name:`argument${t}`,arity:0})),ie=(e,t,n)=>{if(t.arity===0)return{params:[],body:e};if(e.kind===`Lambda`)return{params:e.params.map(e=>({name:e,arity:0})),body:e.body};let r=re(t.arity);return{params:r,body:{kind:`Apply`,operator:e.kind===`Identifier`?e.name:e.kind===`OperatorReference`?e.operator:t.name,args:E(r,n),location:n}}},D=(e,t,n,a)=>{let o=e.location,s=a?void 0:S(e.module);if(s)return e.name===void 0?[]:[...s].map(([t,n])=>{let r=re(n.arity);return ne(`${e.name}!${t}`,n.key,[...e.params,...r],r,o)});let c=a??T(e.module,n),l=`#${_.value++}`,u=new Map(e.substitutions.map(e=>[e.name,e.expression])),d=Td(c),f=e=>u.get(e.name)??{kind:`Identifier`,name:e.name,location:o};y.push({module:e.module,instancer:n,lets:t,substitutions:new Map(d.map(e=>[e.name,f(e)])),location:o});let p=new Set(e.params.map(e=>e.name)),m=e=>kd(f(e),p),h=d.map(t=>{let n=ie(f(t),t,o);return{kind:`Operator`,name:`${t.name}${l}`,params:[...m(t)?e.params:[],...n.params],body:n.body,isLocal:!0,isRecursive:!1,location:o}}),g=[],b=Fi({params:e.params,substitutions:new Map(d.map(t=>[t.name,m(t)?{kind:`Apply`,operator:`${t.name}${l}`,args:E(e.params,o),location:o,resolution:vr}:{kind:`Identifier`,name:`${t.name}${l}`,location:o,resolution:vr}])),variables:new Set(c.variables),getDefinition:e=>r.get(e),isParameterized:e=>i.get(e)===!0,addDefinition:(t,n)=>{let r=`${t}@${e.module}${l}.${g.length}`,i=n(r);return g.push(i.kind===`Operator`?{...i,name:r}:Dd(i,r)),r},createName:v}),x=new Set(d.map(e=>e.name)),ee=[...c.exported].filter(([e])=>!x.has(e)).map(([t,n])=>{let r=b.getKey(n.key),i=re(n.arity),a=[...e.params,...i];return ne(e.name===void 0?t:`${e.name}!${t}`,r,a,r===n.key?i:a,o)});return[...h,...g,...ee]},ae=e=>[...e].flatMap(([e,t])=>{let n=r.get(t.key);return n?[{...n,name:e}]:[]}),oe=(e,a)=>{let o=ks(e,t.loadClass?.(e.name)),s=new Map([...du.map(e=>[e.name,{key:e.name,arity:e.arity}]),...a.symbols]),c=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=[],p=[...o.constants],m=o.variables.map(e=>e.name),h=o.variables.map(e=>e.location),g=(e,t)=>e.forEach((e,n)=>{s.set(n,e),t&&c.set(n,e)});o.extends.forEach(e=>{let t=a.modules.get(e),n=t?void 0:S(e);if(n){g(n,!0);return}let r=t??T(e,o.name);p.push(...r.constants.filter(e=>p.every(t=>t.name!==e.name))),r.variables.forEach((e,t)=>{m.includes(e)||(m.push(e),h.push(r.variableLocations[t]))}),g(r.exported,!0),r.modules.forEach((e,t)=>u.set(t,e)),d.push(r)}),o.constants.forEach(e=>c.set(e.name,{key:e.name,arity:e.arity,declaration:`Constant`})),o.variables.forEach(e=>c.set(e.name,{key:e.name,arity:0,declaration:`Variable`}));let _=p.length===0&&m.length===0,v=e=>o===n?e.name:`${e.name}@${a.id}`,y=/* @__PURE__ */ new Map,b=e=>({imported:s,importedAt:y,definitions:new Map(e.definitions.map(e=>[e.name,e])),getKey:v}),x=()=>new Map([...a.modules,...u]),ee=e=>new Map([...s,...[...o.constants.map(e=>({...e,kind:`Constant`})),...o.variables.map(e=>({...e,kind:`Variable`}))].filter(t=>Sr(t.location,e)).map(e=>[e.name,{key:e.name,arity:e.arity,declaration:e.kind}]),...o.definitions.filter(t=>Sr(t.location,e)).map(e=>[e.name,{key:v(e),arity:Cr(e)}])]),C=e=>{let t=x();if(t.has(e.name))throw Ed(e);a.nested.push(e);let n=oe(e,{id:`${a.id}/${e.name}`,symbols:ee(e.location),modules:t,nested:a.nested});u.set(e.name,n),l.has(e.name)||l.set(e.name,n)};[...o.instances.map(e=>({location:e.location,link:()=>{let t=te(e,o,b(o),_,x().get(e.module));t.forEach((t,n)=>{s.has(n)||y.set(n,e.location)}),g(t,!e.isLocal)}})),...o.modules.map(e=>({location:e.location,link:()=>C(e)}))].sort((e,t)=>Sr(e.location,t.location)?-1:1).forEach(e=>e.link()),ni(o,b(o));let w=e=>{let t=o.instances.find(t=>t.module===e.name);return t!==void 0&&Sr(e.location,t.location)},E=e=>{let t=o.modules.find(t=>t.name===e.module);return t?w(t)?u.get(t.name):void 0:x().get(e.module)},ne=Uu(zi(o,(e,t)=>D(e,t,o.name,E(e))),ae(s));ai(ne,b(ne)),ne.definitions.forEach(e=>{let t=v(e);r.set(t,e),i.set(t,!_);let n={key:t,arity:Cr(e)};s.set(e.name,n),e.isLocal||c.set(e.name,n)}),xd(ne,{constants:new Set(p.map(e=>e.name)),variables:new Set(m),getDefinition:e=>r.get(s.get(e)?.key??e)});let re={module:ne,constants:p,variables:m,variableLocations:h,visible:s,exported:c,modules:u,extended:d};return f.push(re),re},se=w(n).linked,ce=e=>se.visible.get(e)?.key??e;se.visible.forEach((e,t)=>{let n=r.get(e.key);n&&e.key!==t&&r.set(t,n)});let le=[],ue=(e,t)=>{t.has(e)||(t.add(e),e.extended.forEach(e=>ue(e,t)),le.push(...e.module.assumptions))};ue(se,/* @__PURE__ */ new Set);let de=se.constants.map(e=>e.name),fe=se.variables,pe=e=>e.module===void 0?[e.name,ce(e.name)]:e.module===n.name||de.includes(e.name)?[]:[(c.get(e.module)??l.get(e.module))?.visible.get(e.name)?.key??e.name],O=e=>{let t=r.get(e);return t?.kind===`Operator`?t.params.length:se.constants.find(t=>t.name===e)?.arity??0},k=/* @__PURE__ */ new Map,A=/* @__PURE__ */ new Set,me=(e,t)=>{a.set(e,t),r.delete(e),k.delete(e),A.add(e)};e.constants.filter(e=>e.args===void 0).forEach(e=>{let t=wd(e.value);pe(e).forEach(e=>{let n=O(e);n===0?k.set(e,t):me(e,{kind:`Builtin`,name:e,arity:n,evaluate:()=>t,evaluateUnary:void 0,evaluateBinary:void 0,isLazy:!0})})});let he=/* @__PURE__ */ new Map;e.constants.forEach(e=>{if(e.args===void 0)return;let t=`${e.module??``}!${e.name}`,n=he.get(t)??{name:e.name,module:e.module,rows:[]};if(n.rows.length>0&&n.rows[0][0].length!==e.args.length)throw new d(`The arity of the operator ${e.name} is inconsistent in the configuration file.`);n.rows.push([e.args.map(wd),wd(e.value)]),he.set(t,n)}),he.forEach(e=>pe(e).forEach(t=>me(t,Od(e.name,O(t)||e.rows[0][0].length,e.rows))));let ge=new Map(e.substitutions.flatMap(e=>pe(e).map(t=>[t,ce(e.target)])));e.substitutions.filter(e=>e.module===void 0).forEach(t=>{let n=t.name,i=t.target;if(!de.includes(n)&&!se.visible.has(n))throw new d(`In the configuration file, the identifier ${n} does not appear in the specification.`);if(e.substitutions.some(e=>e.name===i))throw new d(`In the configuration file, the identifier ${i} appears\non the right-hand side of a <- after already appearing on the\nleft-hand side of one.`);let o=ce(i),s=r.get(o);if(!(s!==void 0||a.has(o)||k.has(o)||de.includes(i)||fe.includes(i)))throw new d(`The configuration file substitutes for ${n} with the undefined identifier ${i}.`);if(s?.kind===`Operator`&&s.params.length!==(se.constants.find(e=>e.name===n)?.arity??se.visible.get(n)?.arity))throw new d(`The configuration file substitutes for ${n} with ${i} of different number of arguments.`)}),de.forEach(e=>{if(!k.has(e)&&!ge.has(e)&&!A.has(e))throw new d(`The constant ${e} is not assigned a value by the configuration`)});let _e={runtime:s,definitions:r,builtins:a,constants:k,substitutions:ge,variables:fe,variableIndex:Ad(fe,f.flatMap(e=>e.module.variables.map(e=>e.name))),definitionValues:/* @__PURE__ */ new Map,constantLevels:/* @__PURE__ */ new Map,evaluators:/* @__PURE__ */ new WeakMap};return Cd(y,e=>{let t=c.get(e)??l.get(e)??se;return{constants:t.constants,variables:t.variables,definitions:[...new Set([...t.visible.values()].flatMap(e=>r.get(e.key)??[]))],assumptions:t.module.assumptions.map(e=>e.expression),getDefinition:e=>r.get(t.visible.get(e)?.key??e)}}),ge.forEach((e,t)=>{let n=r.get(e);if(de.includes(t)&&n&&!Ka(n,_e))throw new d(`The configuration file substitutes constant ${t} with non-constant ${e}`)}),{environment:_e,assumptions:le,variableLocations:se.variableLocations,instanceActions:b}},Pd={kind:`Boolean`,value:!0},Fd={kind:`Boolean`,value:!1},Id=e=>e?Pd:Fd,Ld=e=>e.kind===`State`||e.kind===`Enabled`||e.kind===`Action`,Rd=e=>e.kind===`State`||e.kind===`Enabled`||e.kind===`Boolean`,Q=(e,t)=>({kind:e,body:t}),zd=(e,t,n)=>({kind:e,operands:[t,n]}),Bd=(e,t)=>({kind:e,operands:t.flatMap(t=>t.kind===e?Bd(e,t.operands).operands:[t])}),Vd=e=>{switch(e.kind){case`Boolean`:return 0;case`State`:case`Enabled`:return 1;case`Action`:case`Next`:return 2;case`Not`:return Vd(e.body);case`Always`:case`Eventually`:return 3;case`And`:case`Or`:return e.operands.reduce((e,t)=>Math.max(e,Vd(t)),0)}},Hd=e=>{switch(e.kind){case`Action`:return!0;case`Boolean`:case`State`:case`Enabled`:return!1;case`Not`:case`Always`:case`Eventually`:case`Next`:return Hd(e.body);case`And`:case`Or`:return e.operands.some(Hd)}},Ud=(e,t)=>e.kind===t.kind?e.kind===`Boolean`&&t.kind===`Boolean`?e.value===t.value:Ld(e)?e===t:`body`in e&&`body`in t?Ud(e.body,t.body):`operands`in e&&`operands`in t&&e.operands.length===t.operands.length&&e.operands.every((e,n)=>Ud(e,t.operands[n])):!1,Wd=(e,t)=>e.some(e=>Ud(e,t)),Gd=e=>e===`And`?`Or`:`And`,Kd=(e,t)=>{switch(e.kind){case`Boolean`:return t?Id(!e.value):e;case`State`:case`Enabled`:case`Action`:case`Next`:return t?Q(`Not`,e):e;case`Not`:return Kd(e.body,!t);case`And`:case`Or`:return Bd(t?Gd(e.kind):e.kind,e.operands.map(e=>Kd(e,t)));case`Always`:case`Eventually`:{let n=t===(e.kind===`Always`)?`Eventually`:`Always`;return Q(n,Kd(e.body,t))}}},qd=e=>{switch(e.kind){case`Boolean`:return Id(!e.value);case`Not`:return e.body;case`And`:case`Or`:return Bd(Gd(e.kind),e.operands.map(qd));case`Always`:return Q(`Eventually`,qd(e.body));case`Eventually`:return Q(`Always`,qd(e.body));default:return Q(`Not`,e)}},Jd=e=>{switch(e.kind){case`And`:case`Or`:{let t=e.kind===`Or`,n=[];for(let r of e.operands){let e=Jd(r);if(e.kind!==`Boolean`)n.push(e);else if(e.value===t)return Id(t)}return n.length===0?Id(!t):n.length===1?n[0]:Bd(e.kind,n)}case`Not`:{let t=Jd(e.body);return t.kind===`Boolean`?Id(!t.value):Q(`Not`,t)}case`Always`:case`Eventually`:{let t=Jd(e.body);return Q(e.kind,t.kind===e.kind?t.body:t)}default:return e}},Yd=e=>e.kind===`Always`&&e.body.kind===`Eventually`?e.body.body:void 0,Xd=e=>{switch(e.kind){case`And`:{let t=[],n={value:1};for(let r of e.operands){let e=Xd(r);if(e.kind===`And`)t.push(...e.operands);else{if(e.kind===`Or`&&(n.value*=e.operands.length,n.value>2147483647))throw new f(`TLC cannot handle the temporal formula because it exceeds the maximum supported size in disjunctive normal form`);t.push(e)}}if(n.value===1)return{kind:`And`,operands:t};let r=Array.from({length:n.value},()=>[]),i={groups:1,repeat:n.value};for(let e of t){if(e.kind!==`Or`){r.forEach(t=>t.push(e));continue}i.repeat/=e.operands.length;let t={value:0};for(let n=0;n<i.groups;n++)for(let n of e.operands)for(let e=0;e<i.repeat;e++)r[t.value++].push(n);i.groups*=e.operands.length}return{kind:`Or`,operands:r.map(e=>Bd(`And`,e))}}case`Or`:{let t=[],n=[];for(let r of e.operands){let e=Xd(r);for(let r of e.kind===`Or`?e.operands:[e]){let e=Yd(r);e?t.push(e):n.push(r)}}if(t.length>0){let e=t.length===1?t[0]:Bd(`Or`,t);n.push(Q(`Always`,Q(`Eventually`,e)))}return Bd(`Or`,n)}case`Not`:return Ld(e.body)?e:Xd(qd(e.body));default:return e}},Zd=e=>{switch(e.kind){case`And`:case`Or`:return e.operands.length===1?Zd(e.operands[0]):Bd(e.kind,e.operands.map(Zd));case`Not`:return e.body.kind===`Not`?Zd(e.body.body):Q(`Not`,Zd(e.body));case`Always`:case`Eventually`:case`Next`:return Q(e.kind,Zd(e.body));default:return e}},Qd=e=>{switch(e.kind){case`And`:case`Or`:{if(e.operands.length===1)return Qd(e.operands[0]);let t=Math.floor(e.operands.length/2);return zd(e.kind,Qd(Bd(e.kind,e.operands.slice(0,t))),Qd(Bd(e.kind,e.operands.slice(t))))}case`Not`:case`Always`:case`Eventually`:case`Next`:return Q(e.kind,Qd(e.body));default:return e}},$d=(e,t)=>{e.kind===`Eventually`&&!Wd(t,e)&&t.push(e),`body`in e&&$d(e.body,t),`operands`in e&&e.operands.forEach(e=>$d(e,t))},ef=e=>{let t=e.filter(Rd),n=e.flatMap(e=>e.kind===`Not`&&Rd(e.body)?[e.body]:[]);return!t.some(e=>Wd(n,e))},tf=e=>{let t=[...e],n=[];for(;t.length>0;){let e=t.pop();if(!e)break;switch(e.kind){case`Not`:t.push(e.body);break;case`Next`:n.push(e),t.push(e.body);break;case`Always`:case`Eventually`:n.push(e,Q(`Next`,e)),t.push(e.body);break;case`And`:case`Or`:t.push(...e.operands),n.push(e);break;case`Action`:throw new f(`TLC encountered actions while constructing the tableau`);default:n.push(e)}}return n},nf=(e,t,n)=>{if(e.kind===t&&`body`in e)return{first:e.body,second:Q(`Next`,e)};if(e.kind===n&&`operands`in e)return{first:e.operands[0],second:e.operands[1]}},rf=(e,t,n)=>e.flatMap(e=>{let r=nf(e,t,n);return r?[{whole:e,first:r.first,second:r.second}]:[]}),af=(e,t)=>e.every(e=>Wd(t,e))&&t.every(t=>Wd(e,t)),of=(e,t)=>[...e.filter(e=>!t.some(t=>af(e,t))),...t],sf=e=>{let t=tf(e),n=rf(t,`Always`,`And`),r=rf(t,`Eventually`,`Or`),i=e=>{for(let t of e){let n=nf(t,`Eventually`,`Or`);if(n&&!(Wd(e,n.first)||Wd(e,n.second)))return of(a([...e,n.first]),a([...e,n.second]))}let t=r.find(t=>(Wd(e,t.first)||Wd(e,t.second))&&!Wd(e,t.whole));return t?a([...e,t.whole]):[e]},a=e=>{if(!ef(e))return[];let t=[...e];for(let e=0;e<t.length;e++){let n=nf(t[e],`Always`,`And`);n&&(Wd(t,n.first)||t.push(n.first),Wd(t,n.second)||t.push(n.second))}let r={isChanged:!0};for(;r.isChanged;){r.isChanged=!1;for(let e of n)Wd(t,e.first)&&Wd(t,e.second)&&!Wd(t,e.whole)&&(t.push(e.whole),r.isChanged=!0)}return t.length>e.length&&!ef(t)?[]:i(t)};return a(e)},cf=e=>({particle:e,successors:[],statePredicates:e.filter(e=>Vd(e)<=1)}),lf=e=>{let t=sf([e]).map(cf),n=t.length;for(let e=0;e<t.length;e++){let n=t[e].particle.flatMap(e=>e.kind===`Next`?[e.body]:[]);for(let r of sf(n)){let n=t.findIndex(e=>af(e.particle,r));n===-1&&t.push(cf(r)),t[e].successors.push(n===-1?t.length-1:n)}}return{nodes:t,initialCount:n}},uf=(e,t)=>!Wd(e,t)||Wd(e,t.body),df=(e,t)=>{if(e.kind===`Eventually`&&e.body.kind===`Always`&&Vd(e.body.body)<3){t.eventuallyAlways.push(e.body.body);return}let n=Yd(e);if(n){let e=Vd(n);if(e<=1){t.infinitelyOftenStates.push(n);return}if(e===2){t.infinitelyOftenActions.push(n);return}}if(Hd(e))throw new f(`TLC cannot handle the temporal formula: actions may only appear as []<>A or <>[]A`);t.formulas.push(e)},ff=(e,t)=>{let n=e.findIndex(e=>Ud(e,t));return n===-1?(e.push(t),e.length-1):n},pf=e=>{let t=Xd(Jd(Kd(e,!1)));if(t.kind===`Boolean`&&!t.value)return[];let n=[];for(let e of t.kind===`Or`?t.operands:[t]){let t=Zd(e),r={eventuallyAlways:[],infinitelyOftenStates:[],infinitelyOftenActions:[],formulas:[]};for(let e of t.kind===`And`?t.operands:[t])df(e,r);let i=r.formulas,a=i.length===0?void 0:i.length===1?i[0]:Bd(`And`,i),o=n.find(e=>e.formula===void 0||a===void 0?e.formula===a:Ud(e.formula,a));o?o.classifications.push(r):n.push({formula:a,classifications:[r]})}return n.map(e=>{let t=e.formula&&Qd(e.formula),n=[];t&&$d(t,n);let r=[],i=[],a=e.classifications.map(e=>({infinitelyOftenActions:e.infinitelyOftenActions.map(e=>ff(i,e)),infinitelyOftenStates:e.infinitelyOftenStates.map(e=>ff(r,e)),eventuallyAlways:e.eventuallyAlways.map(e=>ff(i,e))}));return{tableau:t&&lf(t),promises:n,stateChecks:r,actionChecks:i,models:a}})},mf=/* @__PURE__ */ new Set([`~>`,`-+->`]),hf=/* @__PURE__ */ new WeakMap,gf=/* @__PURE__ */ new WeakSet,_f=(e,t)=>({environment:e,scope:t,state:void 0,next:void 0}),vf=e=>new f(`TLC cannot handle the temporal formula at ${q(e)}`),$=(e,t,n,r=/* @__PURE__ */ new Set)=>{let i=e=>{let r=Ra(t,e);if(!r)return;if(r.kind===`Value`)return 0;if(r.kind===`Thunk`)return $(r.expression,r.scope,n);let i=r.operator;return i.kind===`Closure`?$(i.body,i.scope,n):0},a=e=>{if(n.variableIndex.has(e))return 1;if(n.constants.has(e))return 0;let t=Wa(e,n);if(t)return yf(t,n);let r=n.builtins.get(n.substitutions.get(e)??e);return r?+!!r.isStateLevel:void 0},o=(e,t)=>r.has(e)?0:J(t)?i(e)??a(e)??0:a(e)??i(e)??0,s=e=>{let i={value:0};return mi(e,(e,a)=>(i.value=Math.max(i.value,$(e,t,n,a.length===0?r:/* @__PURE__ */ new Set([...r,...a]))),e)),i.value};switch(e.kind){case`Prime`:case`Unchanged`:case`BoxAction`:case`AngleAction`:return 2;case`Enabled`:return 1;case`Always`:case`Eventually`:case`WeakFairness`:case`StrongFairness`:return 3;case`UnboundedQuantifier`:return e.isTemporal?3:s(e);case`Identifier`:return o(e.name,e);case`OperatorReference`:return o(e.operator,e);case`Apply`:return mf.has(e.operator)?3:e.operator===`\\cdot`?2:Math.max(o(e.operator,e),s(e));default:return s(e)}},yf=(e,t)=>{let n=hf.get(e);if(n!==void 0)return n;hf.set(e,0);let r=e.kind===`Function`?e.bounds:[],i=Math.max($(e.body,void 0,t),...r.map(e=>$(e.set,void 0,t)));return hf.set(e,i),i},bf=(e,t,n,r,i=/* @__PURE__ */ new Set)=>{let a=(e,t,a=i)=>bf(e,t,n,r,a);if(e.kind===`And`)return e.operands.flatMap(e=>a(e,t));if(e.kind===`Label`)return a(e.body,t);if(e.kind===`Let`)return a(e.body,xf(e,t,n));if(e.kind===`Identifier`){let r=J(e)?Ra(t,e.name):void 0;if(r?.kind===`Thunk`)return a(r.expression,r.scope);let o=n.constants.has(e.name)?void 0:Wa(e.name,n);if(!r&&o?.kind===`Operator`&&o.params.length===0&&yf(o,n)>0){if(i.has(o))throw new d(`The definition of ${e.name} refers to itself`);return a(o.body,void 0,/* @__PURE__ */ new Set([...i,o]))}}let o=_f(n,t);if(e.kind===`Apply`&&$(e,t,n)===3){let t=uo(e,o),r=J(e)?void 0:Wa(e.operator,n);if(t?.kind===`Closure`&&!r?.isRecursive)return a(t.body,Co(t,e.args,o))}if(r&&e.kind===`Forall`&&$(e.body,t,n)===3&&e.bounds.every(e=>$(e.set,t,n)===0)){let t=[];return Ya(e.bounds,o,n=>(t.push(...a(e.body,n)),!1)),t}return[{expression:e,scope:t}]},xf=(e,t,n)=>{let r=To(e.definitions,_f(n,t));for(let e=r;e&&e!==t;e=e.parent)e.binding.kind===`Thunk`&&gf.add(e.binding);return r},Sf=(e,t)=>({kind:`AngleAction`,action:e,subscript:t,location:e.location}),Cf=(e,t,n)=>{let r=(e,t,r)=>{let i=r===0?$(e,t,n):r;if(i===0){let r=X(e,_f(n,t));if(typeof r!=`boolean`)throw new f(`TLC expected a boolean in the temporal formula at ${q(e)}`);return Id(r)}return i===1?{kind:`State`,expression:e,scope:t}:{kind:`Action`,expression:e,unchanged:void 0,scope:t}},i={depth:0},a=(e,t,n,a)=>{if(i.depth>=100)throw new f(`TLC overflowed the stack while expanding the temporal formula at ${q(n)}`);i.depth++;let o=c(e,t);i.depth--;let s=Vd(o);return s>2?o:r(n,a,s)},o=(e,t)=>{let r=e.kind===`Identifier`?e.name:e.operator,i=_f(n,t),o=J(e)||Wa(r,n)===void 0?Ra(t,r):void 0;if(o?.kind===`Thunk`&&gf.has(o))return a(o.expression,o.scope,e,t);let s=o?.kind===`Operator`?o.operator:o?void 0:J(e)?fo(r,i):co(r,n);if(s?.kind!==`Closure`)throw vf(e);let c=e.kind===`Apply`?e.args:[];return a(s.body,Co(s,c,i),e,t)},s=(e,t)=>{if(!e.bounds.every(e=>$(e.set,t,n)===0))throw vf(e);let i=[];Ya(e.bounds,_f(n,t),t=>(i.push(c(e.body,t)),!1));let a=e.kind===`Forall`;if(i.length===0)return Id(a);let o=Bd(a?`And`:`Or`,i),s=Vd(o);return s>2?o:r(e,t,s)},c=(e,t)=>{let i=$(e,t,n);if(i<=2)return r(e,t,i);switch(e.kind){case`Label`:return c(e.body,t);case`Let`:return c(e.body,xf(e,t,n));case`Identifier`:return o(e,t);case`Apply`:{let n=e.args;return e.operator===`~>`?Q(`Always`,zd(`Or`,Q(`Not`,c(n[0],t)),Q(`Eventually`,c(n[1],t)))):e.operator===`~`&&!J(e)?Q(`Not`,c(n[0],t)):e.operator===`=>`?zd(`Or`,Q(`Not`,c(n[0],t)),c(n[1],t)):o(e,t)}case`And`:case`Or`:return Bd(e.kind,e.operands.map(e=>c(e,t)));case`Forall`:case`Exists`:return s(e,t);case`If`:{if($(e.condition,t,n)===0){let r=X(e.condition,_f(n,t));if(typeof r==`boolean`)return c(r?e.consequent:e.alternative,t)}let r=c(e.condition,t);return zd(`Or`,zd(`And`,r,c(e.consequent,t)),zd(`And`,Q(`Not`,r),c(e.alternative,t)))}case`Always`:case`Eventually`:return Q(e.kind,c(e.expression,t));case`WeakFairness`:case`StrongFairness`:{let n=Sf(e.action,e.subscript),r={kind:`Enabled`,step:e.enabled??n,scope:t},i=Q(`Not`,r),a={kind:`Action`,expression:e.action,unchanged:{kind:`Unchanged`,expression:e.subscript,location:n.location},scope:t,enabled:r};return e.kind===`WeakFairness`?Q(`Always`,Q(`Eventually`,zd(`Or`,i,a))):zd(`Or`,Q(`Eventually`,Q(`Always`,i)),Q(`Always`,Q(`Eventually`,a)))}default:throw vf(e)}};return c(e,t)},wf=(e,t,n,r,i)=>{let a=e=>wf(e,t,n,r,i);switch(e.kind){case`Boolean`:return e.value;case`State`:case`Enabled`:{let n=i.get(e);if(n!==void 0)return n;let a={environment:r,scope:e.scope,state:t,next:void 0},o=e.kind===`State`?Ha(X(e.expression,a),`a temporal property predicate`):wa(e.step,a);return i.set(e,o),o}case`Action`:{if(e.enabled&&i.get(e.enabled)===!1)return!1;let a={environment:r,scope:e.scope,state:t,next:n};return e.unchanged&&Ha(X(e.unchanged,a),`a subscript`)?!1:Ha(X(e.expression,a),`an action predicate`)}case`Not`:return!a(e.body);case`And`:return e.operands.every(a);case`Or`:return e.operands.some(a);case`Next`:return wf(e.body,n??t,void 0,r,/* @__PURE__ */ new Map);case`Always`:case`Eventually`:throw new f(`TLC cannot evaluate a temporal formula in a single step`)}},Tf=(e,t,n,r,i)=>{let a=e=>e+1<t.length?e+1:n,o=e=>t.map((e,t)=>t).filter(t=>t>=Math.min(e,n)),s=(e,a=r)=>Tf(e,t,n,a,i);switch(e.kind){case`Not`:return!s(e.body);case`And`:return e.operands.every(e=>s(e));case`Or`:return e.operands.some(e=>s(e));case`Next`:return s(e.body,a(r));case`Always`:return o(r).every(t=>s(e.body,t));case`Eventually`:return o(r).some(t=>s(e.body,t));default:return wf(e,t[r],t[a(r)],i,/* @__PURE__ */ new Map)}},Ef=/* @__PURE__ */ new WeakMap,Df={value:0},Of=e=>{let t=Ef.get(e);if(t!==void 0)return t;let n=e.kind===`Boolean`?String(e.value):`body`in e?`${e.kind}(${Of(e.body)})`:`operands`in e?`${e.kind}(${e.operands.map(Of).join(`,`)})`:`${e.kind}#${Df.value++}`;return Ef.set(e,n),n},kf=(e,t)=>e.every((e,n)=>Be(e,t[n])),Af=(e,t,n)=>{let r=new Int32Array(e).fill(-1),i=new Int32Array(e),a=new Uint8Array(e),o=[],s={value:0},c=/* @__PURE__ */ new Map,l=e=>{let n=c.get(e);if(n)return n;let r=t(e);return c.set(e,r),r};for(let t=0;t<e;t++){if(r[t]!==-1)continue;let e=[],u=t=>{r[t]=s.value,i[t]=s.value++,o.push(t),a[t]=1,e.push({node:t,position:0})};for(u(t);e.length>0;){let t=e[e.length-1],s=l(t.node);if(t.position<s.length){let e=s[t.position++];r[e]===-1?u(e):a[e]&&(i[t.node]=Math.min(i[t.node],r[e]));continue}e.pop();let d=e[e.length-1];if(d&&(i[d.node]=Math.min(i[d.node],i[t.node])),i[t.node]!==r[t.node])continue;let f=[];for(;;){let e=o.pop();if(e===void 0||(a[e]=0,f.push(e),e===t.node))break}let p=n(f,l);if(f.forEach(e=>c.delete(e)),p)return}}},jf=(e,t,n,r)=>{if(e===t)return[e];let i=/* @__PURE__ */ new Map([[e,-1]]),a=[e];for(let e=0;e<a.length;e++)for(let o of r(a[e]))if(!i.has(o)&&n.has(o)){if(i.set(o,a[e]),o===t){let e=[];for(let n=t;n!==-1;n=i.get(n)??-1)e.push(n);return e.reverse()}a.push(o)}return[e]},Mf=e=>e.filter((t,n)=>n===0||e[n-1]!==t),Nf=(e,t,n)=>{if(e.length===0)return;let r=t.map(e=>Cf(e.expression,e.scope,n)),i=e.map(e=>Q(`Not`,Cf(e.expression,e.scope,n))),a=i.length===1?i[0]:Bd(`Or`,i),o=r.length===0?a:Bd(`And`,[...r,a]),s=pf(o);if(s.length===0)throw new f(`Temporal formula is a tautology (its negation is unsatisfiable)`);let c=s.map(e=>({solution:e,stateResults:[],actionResults:[],consistency:[],product:e.tableau&&{states:[],tableauNodes:[],edges:[],initial:[],parents:[]},productNodes:/* @__PURE__ */ new Map,nodesByState:/* @__PURE__ */ new Map})),l=/* @__PURE__ */ new Map,u=c.map(e=>e.solution.actionChecks.map(e=>{let t=Of(e),n=l.get(t);return n===void 0?(l.set(t,l.size),l.size-1):n})),d=[],p=[],m=[],h=[],g=(e,t,r)=>e.every(e=>wf(e,t,void 0,n,r)),_=(e,t,n,r,i)=>{let a=n*(e.solution.tableau?.nodes.length??1)+r,o=e.productNodes.get(a);if(o!==void 0)return{node:o,isNew:!1};let s=t.states.length;e.productNodes.set(a,s),t.states.push(n),t.tableauNodes.push(r),t.edges.push([]),t.parents.push(i);let c=e.nodesByState.get(n);return c?c.push(s):e.nodesByState.set(n,[s]),{node:s,isNew:!0}},v=(t,r)=>{let a=t.map(e=>d[e]);return(e.find((e,t)=>!Tf(i[t].body,a,r,0,n))??e[0]).name},y=(e,t,n,r)=>{let i=e.solution.models.some(e=>e.eventuallyAlways.length===0&&e.infinitelyOftenStates.length===0&&e.infinitelyOftenActions.length===0),a=n.nodes.length,o=(e.nodesByState.get(r)??[]).map(e=>({node:e,isDone:!1}));for(;o.length>0;){let r=o.pop();if(!r)break;let s=t.states[r.node],c=n.nodes[t.tableauNodes[r.node]].successors;if(r.isDone&&i&&c.some(e=>{let t=n.nodes[e];return t.particle.length===0&&t.successors.every(t=>t===e)})){let e=Mf(w(t,r.node).map(e=>t.states[e]));return{name:v(e,e.length-1),path:e}}let l=e.consistency[s];p[s].forEach((n,i)=>{for(let s of c){if(!l[i*a+s])continue;let c=_(e,t,n,s,r.node);t.edges[r.node].push(c.node,i),c.isNew&&p[n]!==void 0&&o.push({node:c.node,isDone:!0})}})}},b=(e,t)=>{h.push(e),d[e]=t;for(let n of c){let r=n.solution.tableau,i=n.product;if(!r||!i)continue;let a=/* @__PURE__ */ new Map;for(let o=0;o<r.initialCount;o++)g(r.nodes[o].statePredicates,t,a)&&i.initial.push(_(n,i,e,o,-1).node)}},x=(e,t,r)=>{n.runtime.setLivenessSource(e),d[e]=t;let i=[],a=/* @__PURE__ */ new Map;for(let n of[...r,{index:e,state:t}]){let t=a.get(n.index);t!==void 0&&(n.index<e||t.some(e=>kf(e.state,n.state)))||(i.push(n),t?t.push(n):a.set(n.index,[n]))}p[e]=i.map(e=>e.index),m[e]=i.map(e=>e.state);let o=/* @__PURE__ */ new Map,s=i.map(()=>/* @__PURE__ */ new Map);for(let r of c){let a=r.solution;r.stateResults[e]=Uint8Array.from(a.stateChecks,e=>+!!wf(e,t,void 0,n,o));let c=a.tableau,l=r.product;if(!c||!l)continue;let u=c.nodes.length,d=new Uint8Array(i.length*u);i.forEach((e,t)=>{c.nodes.forEach((n,r)=>{let i=g(n.statePredicates,e.state,s[t]);d[t*u+r]=+!!i})}),r.consistency[e]=d;let f=y(r,l,c,e);if(f)return f}},S=e=>{n.runtime.setLivenessSource(e);let t=d[e],r=m[e],i=r.map(()=>new Int8Array(l.size).fill(-1));c.forEach((a,o)=>{let s=a.solution,c=u[o],l=a.stateResults[e],d=new Map(s.stateChecks.map((e,t)=>[e,l[t]===1])),f=s.actionChecks.length,p=new Uint8Array(r.length*f);r.forEach((e,r)=>{let a=i[r];for(let i=0;i<f;i++){let o=c[i];if(a[o]===-1){let r=s.actionChecks[i];a[o]=+!!wf(r,t,e,n,d)}p[r*f+i]=a[o]}}),a.actionResults[e]=p})},ee=(e,t)=>(e.actionResults[t]===void 0&&S(t),e.actionResults[t]),C=e=>e.product??{states:d.map((e,t)=>t),tableauNodes:d.map(()=>-1),edges:Array.from({length:d.length},(e,t)=>(p[t]??[]).flatMap((e,t)=>[e,t])),initial:h,parents:[]},w=(e,t)=>{if(e.parents.length>0){let n=[];for(let r=t;r!==-1;r=e.parents[r])n.push(r);return n.reverse()}let n=new Map(e.initial.map(e=>[e,-1])),r=[...e.initial];for(let i=0;i<r.length&&!n.has(t);i++){let t=e.edges[r[i]];for(let e=0;e<t.length;e+=2)n.has(t[e])||(n.set(t[e],r[i]),r.push(t[e]))}let i=[];for(let e=t;e!==-1;e=n.get(e)??-1)i.push(e);return i.reverse()},T=e=>{let t=e.solution,n=t.tableau,r=C(e),i=t.actionChecks.length,a=(t,n,a)=>ee(e,r.states[t])[n*i+a]===1;for(let i of t.models){let o=(e,t)=>i.eventuallyAlways.every(n=>a(e,t,n)),s=e=>{let t=r.edges[e],n=[];for(let r=0;r<t.length;r+=2)o(e,t[r+1])&&n.push(t[r]);return n},c={value:void 0};if(Af(r.states.length,s,(s,l)=>{let u=new Set(s);if(s.length===1&&!l(s[0]).includes(s[0]))return!1;let d=i.infinitelyOftenStates.map(t=>s.find(n=>e.stateResults[r.states[n]][t]===1)),f=i.infinitelyOftenActions.map(e=>{for(let t of s){let n=r.edges[t];for(let r=0;r<n.length;r+=2)if(u.has(n[r])&&o(t,n[r+1])&&a(t,n[r+1],e))return[t,n[r]]}}),p=t.promises.map(e=>s.find(t=>n!==void 0&&uf(n.nodes[r.tableauNodes[t]].particle,e)));if(!(d.every(e=>e!==void 0)&&f.every(e=>e!==void 0)&&p.every(e=>e!==void 0)))return!1;let m=s[s.length-1],h=[...d.flatMap(e=>e??[]),...f.flatMap(e=>e??[]),...p.flatMap(e=>e??[])],g=[m];for(let e of h)g.push(...jf(g[g.length-1],e,u,l).slice(1));g.length===1&&!l(m).includes(m)&&g.push(l(m).find(e=>u.has(e))??m);let _=jf(g[g.length-1],m,u,l);g.push(..._.slice(1,-1));let y=Mf(w(r,m).map(e=>r.states[e])),b=Mf(g.map(e=>r.states[e]));return b.length>1&&b[b.length-1]===b[0]&&b.pop(),y.pop(),c.value={name:v([...y,...b],y.length),prefix:y,cycle:b},!0}),c.value)return c.value}};return{addInitialState:b,addState:x,findViolation:()=>{for(let e of c){let t=T(e);if(t)return t}}}},Pf=`UnnamedAction`,Ff={module:`--TLA+ BUILTINS--`,start:{line:0,column:0},end:{line:0,column:0}},If=e=>{let t=e.range??Ff;return kt([[`beginLine`,t.start.line],[`beginColumn`,t.start.column],[`endLine`,t.end.line],[`endColumn`,t.end.column],[`module`,t.module]])},Lf=e=>{let t=[[`name`,e.name],[`location`,If(e.location)]];return e.parameters.length===0?kt(t):kt([...t,[`context`,kt(e.parameters)],[`parameters`,I(e.parameters.map(e=>e[0]))]])},Rf=(e,t)=>({name:e,location:t.location,parameters:[],expression:t,scope:void 0}),zf=(e,t)=>({environment:e,scope:t,state:void 0,next:void 0}),Bf=e=>e.kind===`Identifier`?e.name:e.kind===`Apply`?e.operator:void 0,Vf=e=>e.kind===`Apply`?e.args:[],Hf=(e,t,n)=>{let r=Bf(e);if(r===void 0)return;if(J(e)){let e=Ra(t,r);return e?.kind===`Operator`&&e.operator.kind===`Closure`?e.operator:void 0}if(n.constants.has(r)||n.variableIndex.has(r))return;let i=co(r,n);return i?.kind===`Closure`?i:void 0},Uf=(e,t)=>{try{return X(e,zf(t,void 0)),!0}catch(e){if(e instanceof l)return!1;throw e}},Wf=(e,t)=>e?.kind===`Operator`&&e.params.length===0&&e.body.kind!==`Number`&&e.body.kind!==`String`&&Ka(e,t)&&Uf(e.body,t),Gf=(e,t)=>{let n=Wa(e.name,t);return n?.body===e.body&&Wf(n,t)},Kf=(e,t)=>{if(e.kind!==`Identifier`||!J(e))return;let n=Ra(t,e.name);return n?.kind===`Thunk`?n:void 0},qf=(e,t)=>(e?.params??[]).flatMap(e=>{let n=Ra(t,e.name);return n?.kind===`Value`?[[e.name,n.value]]:[]}),Jf=(e,t)=>{try{return e()}catch(e){if(e instanceof l)return t();throw e}},Yf=(e,t,n,r,i)=>{let a=Vf(t),o=()=>[{name:e.name,location:t.location,parameters:[],expression:t,scope:n}];return!r||a.length===0?[{...e,parameters:[],expression:t,scope:n}]:a.some(e=>$(e,n,i)!==0)?o():Jf(()=>[{...e,parameters:a.map((e,t)=>[r.params[t].name.replace(/#\d+$/,``),X(e,zf(i,n))]),expression:t,scope:n}],o)},Xf=(e,t,n,r,i)=>{let a=()=>({name:n?.name??Pf,location:e.location,parameters:qf(n,t),expression:e,scope:t});switch(e.kind){case`Let`:return Xf(e.body,To(e.definitions,zf(r,t)),n,r,i);case`Label`:return Xf(e.body,t,n,r,i);case`Or`:return e.operands.flatMap(e=>Xf(e,t,n,r,i));case`Exists`:return Jf(()=>{let o=[];return Ya(e.bounds,zf(r,t),t=>(o.push(...Xf(e.body,t,n,r,i)),!1)),o.length===0?[a()]:o},()=>[a()])}let o=J(e)?void 0:i.get(Bf(e)??``),s=Hf(e,t,r);if(o)return Yf(o,e,t,s,r);if(!s)return[a()];let c=Vf(e),l=()=>[{name:s.name,location:e.location,parameters:[],expression:e,scope:t}];return Gf(s,r)||c.some(e=>$(e,t,r)!==0)?l():Jf(()=>{let e=c.reduce((e,n,i)=>({name:s.params[i].name,binding:{kind:`Value`,value:X(n,zf(r,t))},parent:e}),s.scope);return Xf(s.body,e,s,r,i)},l)},Zf=(e,t,n,r,i)=>{let a=(e,t)=>Zf(e,t,n,r,i);if(e.kind===`Let`){a(e.body,To(e.definitions,zf(n,t)));return}let o=Kf(e,t);if(o){a(o.expression,o.scope);return}let s=Hf(e,t,n);if(s&&Gf(s,n))return;if(s&&s.params.length===0){if($(s.body,s.scope,n)===1){r.inits.push(Rf(s.name,s.body));return}a(s.body,s.scope);return}if(s&&e.kind===`Apply`&&s.params.length===e.args.length){a(s.body,Co(s,e.args,zf(n,t)));return}if(e.kind===`And`){e.operands.forEach(e=>a(e,t));return}if(e.kind===`Always`){if(e.expression.kind===`BoxAction`){i.push({expression:e.expression.action,scope:t});return}r.temporals.push(Rf(Pf,e));return}let c=$(e,t,n);c<=1?r.inits.push(Rf(Pf,e)):c===3&&r.temporals.push(Rf(Pf,e))},Qf=(e,t,n,r,i)=>{let a=(t,n)=>Qf(e,t,n,r,i);if(t.kind===`Let`){a(t.body,To(t.definitions,zf(r,n)));return}let o=Kf(t,n);if(o){a(o.expression,o.scope);return}let s=Hf(t,n,r);if(s&&Gf(s,r))return;if(s&&s.params.length===Vf(t).length){a(s.body,t.kind===`Apply`?Co(s,t.args,zf(r,n)):s.scope);return}if(t.kind===`Forall`&&Jf(()=>(Ya(t.bounds,zf(r,n),e=>(a(t.body,e),!1)),!0),()=>!1))return;if(t.kind===`And`){t.operands.forEach(e=>a(e,n));return}if(t.kind===`Always`){let a=t.expression;a.kind===`BoxAction`?i.impliedActions.push(Rf(e,a)):$(a,n,r)<2?i.invariants.push(Rf(e,a)):i.impliedTemporals.push(Rf(e,t));return}let c=$(t,n,r);c<=1?i.impliedInits.push(Rf(e,t)):c===3&&i.impliedTemporals.push(Rf(e,t))},$f=(e,t)=>{let n=Wa(e,t);return n?.kind===`Operator`&&!Wf(n,t)?n:void 0},ep=e=>kt([[`name`,e.name],[`location`,If(e.location)]]),tp=(e,t,n)=>{let r={inits:[],actions:[],temporals:[],invariants:[],impliedInits:[],impliedActions:[],impliedTemporals:[]},i=[],a=e.specification===void 0?void 0:$f(e.specification,t);a&&(Zf(a.body,void 0,t,r,i),i.forEach(e=>r.actions.push(...Xf(e.expression,e.scope,void 0,t,n))));let o=e.init===void 0?void 0:co(e.init,t);o?.kind===`Closure`&&r.inits.push(Rf(e.init??``,o.body));let s=e.next===void 0?void 0:co(e.next,t);return s?.kind===`Closure`&&r.actions.push(...Xf(s.body,s.scope,s,t,n)),e.invariants.forEach(e=>{let n=$f(e,t);n&&r.invariants.push(Rf(e,n.body))}),e.properties.forEach(e=>{let n=$f(e,t);n&&Qf(e,n.body,void 0,t,r)}),r},np=(e,t,n)=>tp(e,t,n).actions,rp=e=>{let t=e.parameters.map(e=>H(e[1]));return`${e.name===Pf?`Action`:e.name}${t.length===0?``:`(${t.join(`,`)})`} ${ka(e.location.range??Ff)}`},ip=(e,t,n,r)=>{let i=tp(e,t,r),a=e=>pt(e.map(Lf)),o=e=>pt(e.flatMap(e=>{let n=$f(e,t);return n?[ep(n)]:[]}));return kt([[`inits`,a(i.inits)],[`actions`,a(i.actions)],[`temporals`,a(i.temporals)],[`invariants`,a(i.invariants)],[`impliedinits`,a(i.impliedInits)],[`impliedactions`,a(i.impliedActions)],[`impliedtemporals`,a(i.impliedTemporals)],[`variables`,pt(t.variables.map((e,t)=>kt([[`name`,e],[`location`,If(n[t])]])))],[`actionconstraints`,o(e.actionConstraints)],[`constraints`,o(e.constraints)]])},ap=e=>[...e].map(([e,t])=>`${e}>${t.name}`).sort().join(`,`),op=(e,t)=>{let n=/* @__PURE__ */ new Map;return(/* @__PURE__ */ new Set([...e.keys(),...t.keys()])).forEach(r=>{let i=e.get(r),a=i?t.get(i.name)??i:t.get(r);a&&a.name!==r&&n.set(r,a)}),n},sp=(e,t)=>{if(!k(e))throw new d(`The symmetry values of ${t} must be functions`);let n=V(e),r=/* @__PURE__ */ new Map;return n.domain.forEach((e,t)=>{let i=n.range[t];if(!A(e)||!A(i))throw new d(`Symmetry function must have model values as domain and range`);e.name!==i.name&&r.set(e.name,i)}),r},cp=(e,t)=>{let n=t.definitions.get(e);if(n?.kind!==`Operator`||n.params.length>0)throw new d(`The symmetry function ${e} must specify a set of permutations`);let r=X(n.body,{environment:t,scope:void 0,state:void 0,next:void 0});if(!O(r)||!L(r))throw new d(`The symmetry operator must specify a set of functions`);let i=R(r).elements.map(t=>sp(t,e));if(n.body.kind===`Apply`&&n.body.args.length>=i.length)return[];let a=/* @__PURE__ */ new Map;i.forEach(e=>{e.size>0&&a.set(ap(e),e)});let o=[...a.values()],s={start:0};for(;s.start<a.size;){let e=[...a.values()],t=e.length;o.forEach(n=>e.slice(s.start,t).forEach(e=>{let t=op(n,e),r=ap(t);t.size>0&&!a.has(r)&&a.set(r,t)})),s.start=t}let c=Math.max(256,Math.floor(4194304/a.size));return[...a.values()].map(e=>({images:e,cache:/* @__PURE__ */ new WeakMap,cacheSize:0,cacheLimit:c}))},lp=(e,t)=>{for(let n=0;n<e.length;n++){let r=e[n],i=fp(r,t);if(i===r)continue;let a=e.slice(0,n);a.push(i);for(let r=n+1;r<e.length;r++)a.push(fp(e[r],t));return a}},up=(e,t)=>{let n=[],r=[];for(let i of e){let e=fp(i,t);e===i?n.push(i):r.push(e)}if(r.length===0)return;r.sort(P);let i=[],a=0,o=0;for(;a<n.length&&o<r.length;)i.push(P(n[a],r[o])<0?n[a++]:r[o++]);for(;a<n.length;)i.push(n[a++]);for(;o<r.length;)i.push(r[o++]);return i},dp=e=>e.kind===`Set`?e.elements.length:e.kind===`Function`?e.domain.length:0,fp=(e,t)=>{if(typeof e!=`object`)return e;if(e.kind===`ModelValue`)return t.images.get(e.name)??e;let n=dp(e);if(n===0||n>64)return pp(e,t);let r=t.cache.get(e);if(r!==void 0)return r;let i=pp(e,t);return t.cacheSize>=t.cacheLimit&&(t.cache=/* @__PURE__ */ new WeakMap,t.cacheSize=0),t.cache.set(e,i),t.cacheSize++,i},pp=(e,t)=>{let n=e.kind;if(n===`Set`){let n=up(e.elements,t);return n?Le(n):e}if(n===`Function`||n===`LazyFunction`&&L(e.domain)){let n=V(e),r=lp(n.domain,t),i=lp(n.range,t)??n.range;return r?yt(r.map((e,t)=>[e,i[t]])):i===n.range?n:F(n.domain,i)}if(n===`Interval`||!O(e)||!L(e))return e;let r=R(e),i=lp(r.elements,t);return i?pt(i):r},mp=(e,t,n)=>{for(let r=t.length;r<e.length;r++)t.push(fp(e[r],n));return t},hp=(e,t,n,r)=>{let i=[];for(let a=0;a<e.length;a++){let o=r?r[a]:a,s=fp(e[o],n),c=P(s,t[o]);if(c>0)return;if(r||i.push(s),c<0)return r?e.map(e=>fp(e,n)):mp(e,i,n)}},gp=(e,t,n)=>t.reduce((t,r)=>hp(e,t,r,n)??t,e),_p=[`LAMBDA`,`$$InAssume`,`nullODN`,`nullOpArg`,`nullLabelNode`],vp=/* @__PURE__ */ new Set([`THEOREM`,`LEMMA`,`COROLLARY`,`PROPOSITION`]),yp=new Map(Zl.flatMap(e=>e.map(t=>[t,e[0]]))),bp=e=>yp.get(e)??e,xp=e=>{let t=0;for(let n=0;n<e.length;n++)t=Math.imul(t,31)+e.charCodeAt(n)|0;return t},Sp=()=>{let e={buckets:Array.from({length:11},()=>[]),threshold:8},t=/* @__PURE__ */ new Set,n=[],r=(e,t)=>(xp(e.name)&2147483647)%t,i=()=>{let t=e.buckets.length*2+1,n=Array.from({length:t},()=>[]);for(let i=e.buckets.length-1;i>=0;i--)for(let a of e.buckets[i])n[r(a,t)].unshift(a);e.buckets=n,e.threshold=Math.floor(t*.75)};return{put:a=>{t.has(a.key)||(n.length>=e.threshold&&i(),e.buckets[r(a,e.buckets.length)].unshift(a),t.add(a.key),n.push(a))},inserted:n,enumerate:()=>e.buckets.toReversed().flat()}},Cp=(e,t,n)=>({key:t===`module`?`module ${e}`:e,name:e,kind:t,isLocal:n}),wp=(e,t)=>{let n=e[t],r=e[t+1];if(n.text===`_`&&r.kind===`Operator`)return e[t+2]?.text===`_`?{name:bp(r.text),end:t+3}:{name:r.text,end:t+2};if(n.kind===`Operator`)return{name:n.text===`-`?`-.`:bp(n.text),end:t+2};if(r?.text!==`(`)return{name:n.text,end:t+1};let i=e.findIndex((e,n)=>n>t&&e.text===`)`);return{name:n.text,end:i+1}},Tp=(e,t)=>{let n=[];for(let r=t;;){let t=wp(e,r);if(n.push(t.name),e[t.end]?.text!==`,`)return n;r=t.end+1}},Ep=e=>({line:e.line,column:e.column}),Dp=(e,t,n)=>{let r=/* @__PURE__ */ new Set,i=(a,o)=>{let s={key:o,unit:t,extends:[],instances:[],inner:[],allExtends:r};for(let t=a+1;t<e.length;t++){let a=e[t];if(a.kind===`ModuleEnd`)return{references:s,end:t};if(a.kind===`Separator`&&e[t+1]?.text===`MODULE`){let r=e[t+2].text,a=i(t,`${o}/${r}`);n.set(r,a.references),s.inner.push(a.references),t=a.end}else if(a.text===`EXTENDS`){let n=Tp(e,t+1);s.extends.push(...n),n.forEach(e=>r.add(e))}else a.text===`INSTANCE`&&e[t+1]?.kind===`Identifier`&&s.instances.push(e[t+1].text)}return{references:s,end:e.length}};return i(0,t??``).references},Op=(e,t)=>t!==void 0&&t.line===e.line&&t.column===e.column+e.text.length,kp=e=>{let t=[];for(let n=0;n<e.length;n++){let r=e[n];if(r.text===`<`&&Op(r,e[n+1])&&/^(\d+|\*|\+)$/.test(e[n+1].text)&&e[n+2]?.text===`>`&&Op(e[n+1],e[n+2])){n+=Op(e[n+2],e[n+3])?3:2;continue}let i=r.text===`MODULE`&&e[n-1]?.kind===`Separator`;r.kind!==`String`&&!i&&t.push(r.text)}return t},Ap=e=>{let t=/* @__PURE__ */ new Map,n=[];return e.forEach((r,i)=>{r.kind===`Separator`&&e[i+1]?.text===`MODULE`&&n.push({name:e[i+2].text,start:i});let a=r.kind===`ModuleEnd`?n.pop():void 0;a&&!t.has(a.name)&&t.set(a.name,{start:a.start,end:i+1})}),t},jp=(e,t)=>e.find(e=>e.name===t)??e.map(e=>jp(e.modules,t)).find(Boolean),Mp=(e,t)=>{let n=/* @__PURE__ */ new Map,r=/* @__PURE__ */ new Map,i=i=>{let a=n.get(i??``);if(a)return a;let o=i===void 0?e:tu.get(i)??t?.(i)??Xs(e,i),s=o===void 0?[]:ie(o),c=Ap(s),l=c.get(s[2]?.text??``)??{start:0,end:0},u={module:void 0},d={tokens:s,...l,getModule:()=>u.module??=Zs(o??``)};return n.set(i??``,d),c.forEach((e,t)=>{e.start===l.start||r.has(t)||r.set(t,{tokens:s,...e,getModule:()=>jp(d.getModule().modules,t)??d.getModule()})}),d};return i(void 0),e=>(e===void 0?void 0:r.get(e))??i(e)},Np=(e,t)=>{let n=Mp(e,t),r=e=>{let t=e.tokens,n=e.getModule(),r=[],i=[],o=(e,n)=>{let i=Tp(t,e+1);r.push({location:Ep(t[e]),apply:e=>i.forEach(t=>e.put(Cp(t,n,!1)))})},s=new Set(n.definitions.filter(e=>e.isRecursive).map(e=>e.name)),c={value:0};t.slice(e.start,e.end).forEach((n,a)=>{let l=e.start+a,u=t[l];if(u.kind===`Separator`&&t[l+1]?.text===`MODULE`){if(c.value++,c.value===2){let e=t[l+2].text;r.push({location:Ep(u),apply:t=>t.put(Cp(e,`module`,!1))})}}else u.kind===`ModuleEnd`&&c.value--,c.value===1&&u.kind===`Keyword`&&((u.text===`CONSTANT`||u.text===`CONSTANTS`)&&o(l,`constant`),(u.text===`VARIABLE`||u.text===`VARIABLES`)&&o(l,`variable`),u.text===`RECURSIVE`&&Tp(t,l+1).every(e=>s.has(e))&&o(l,`definition`),vp.has(u.text)&&t[l+1]?.kind===`Identifier`&&t[l+2]?.text===`==`&&(i.push(Ep(u)),r.push({location:Ep(u),apply:e=>e.put(Cp(t[l+1].text,`theorem`,!1))})))}),n.assumptions.forEach(e=>{i.push(e.location);let t=e.name;t!==void 0&&r.push({location:e.location,apply:e=>e.put(Cp(t,`theorem`,!1))})});let l=e=>i.some(t=>t.line===e.line&&t.column===e.column);return n.definitions.forEach(e=>{if(l(e.location))return;let t=bp(e.name);r.push({location:e.location,apply:n=>n.put(Cp(t,`definition`,e.isLocal))})}),n.instances.forEach(e=>{r.push({location:e.location,apply:t=>{let n=a(e.module).enumerate(),r=e.name===void 0?``:`${e.name}!`,i=n.filter(e=>e.kind===`definition`),o=n.filter(e=>e.kind===`theorem`);[...i,...o].forEach(n=>{n.isLocal||t.put(Cp(`${r}${n.name}`,n.kind,e.isLocal))}),e.name!==void 0&&t.put(Cp(e.name,`definition`,e.isLocal))}})}),r.sort((e,t)=>Sr(e.location,t.location)?-1:+!!Sr(t.location,e.location))},i=/* @__PURE__ */ new Map,a=e=>{let t=i.get(e??``);if(t)return t;let o=Sp();i.set(e??``,o),Xl.toReversed().forEach(e=>o.put(Cp(e,`builtin`,!1)));let s=n(e);return s.getModule().extends.forEach(e=>a(e).inserted.forEach(e=>{e.isLocal||o.put(e)})),r(s).forEach(e=>e.apply(o)),o};return a(void 0).enumerate().filter(e=>e.kind===`variable`).map(e=>e.name).reverse()},Pp=(e,t,n)=>{let r=Mp(e,n),i=/* @__PURE__ */ new Set,a=e=>{i.add(e)},o=e=>{e.kind===`ModelValue`&&a(e.name),e.kind===`String`&&a(e.value),e.kind===`Set`&&e.elements.forEach(o)};t.constants.forEach(e=>{e.args?.forEach(o),o(e.value)}),Ql.forEach(a);let s=e=>{let t=r(e);return t.tokens.slice(t.start,t.end)},c=/* @__PURE__ */ new Map,l=/* @__PURE__ */ new Map,u=e=>{let t=l.get(e);if(t)return t;let n=Dp(s(e),e,c);return l.set(e,n),n},d=e=>c.get(e)??u(e),f=/* @__PURE__ */ new Set,p=(e,t)=>c.has(t)||f.has(`${e.key}>${t}`),m=(e,t,n)=>{let r=[...e.extends.map(d),...e.instances.filter(t=>p(e,t)).map(d),...e.inner];for(let e of r){let r=n(e,t);if(r)return r}},h=e=>{let t=(n,r)=>{if(r.has(n.key))return;r.add(n.key);let i=e(n).find(e=>!p(n,e));return i===void 0?m(n,r,t):[n,i]};return t},g=h(e=>e.extends),_=h(e=>e.instances),v=/* @__PURE__ */ new Set([void 0]),y=/* @__PURE__ */ new Map;kp(s(void 0)).forEach((e,t)=>{t===3&&eu.forEach(a),a(e)});let b=u(void 0);for(;;){let e=g(b,/* @__PURE__ */ new Set)??_(b,/* @__PURE__ */ new Set);if(!e)break;let[t,n]=e;f.add(`${t.key}>${n}`),y.set(t.unit,[...y.get(t.unit)??[],n]),!v.has(n)&&(v.add(n),kp(s(n)).forEach(a))}_p.forEach(a);let x=/* @__PURE__ */ new Set,S=e=>{if(x.has(e))return;x.add(e);let t=y.get(e)??[],n=u(e).allExtends;[...t.filter(e=>n.has(e)),...t.filter(e=>!n.has(e))].forEach(S),s(e).forEach(e=>{e.kind===`String`&&a(e.text)})};return S(void 0),$l.forEach(a),[...i]},Fp=(e,t)=>e*((t-e)/2**64),Ip=e=>e.includes(`.`)?e:`${e}.0`,Lp=e=>{let t=Math.abs(e);if(t>=.001&&t<1e7)return Ip(String(e));let[n,r]=e.toExponential().split(`e`);return`${Ip(n)}E${r.replace(`+`,``)}`},Rp=e=>e!==void 0&&e>=`0`&&e<=`9`,zp=e=>{if(e===0)return`0.0`;let t=Lp(e),n={next:0,digits:0,result:``};for(;t[n.next]===`0`;)n.next++;for(;Rp(t[n.next]);)n.result+=t[n.next++],n.digits++;if(n.next===t.length)return n.result;if(t[n.next]!==`.`)return t;if(n.next++,n.digits>=2)for(;Rp(t[n.next]);)n.next++;else{if(n.result+=`.`,n.digits===0)for(;t[n.next]===`0`;)n.result+=t[n.next++];for(;Rp(t[n.next])&&n.digits<2;)n.result+=t[n.next++],n.digits++;for(Rp(t[n.next])&&Number(t[n.next])>=5&&(n.result=Bp(n.result));Rp(t[n.next]);)n.next++}return n.next>=t.length?n.result:t[n.next]===`E`?`${n.result}${t.slice(n.next)}`:t},Bp=e=>{let t=e.length-1;if(t<0)return`1`;let n=e[t],r=e.slice(0,t);return n===`.`?`${Bp(r)}.`:n===`9`?`${Bp(r)}0`:`${r}${Number(n)+1}`},Vp=e=>{let t={value:0};for(;10n**BigInt(t.value+1)<e*10n;)t.value++;let n=10n**BigInt(t.value+1),r=n/e,i=n%e*2n>=e;return Number(`${r+(i?1n:0n)}e-${t.value+1}`)},Hp=(e,t,n)=>{if(Fp(e,t)<1e-10)return;let r=n().sort();return r.reduce((e,t,n)=>{let i=r[n-1];return n>0&&i<0n==t<0n&&t-i<e?t-i:e},9223372036854775807n)},Up=e=>{let t=e.reduce((e,t)=>e+t,0);if(t===0)return;let n=e.flatMap((e,t)=>e>0?[t]:[]),r=e.reduce((e,t,n)=>e+t*n,0),i=Math.floor(t*.95),a={count:0},o=n.find(t=>(a.count+=e[t],a.count>i));return`The average outdegree of the complete state graph is ${Math.round(r/t)} (minimum is ${n[0]}, the maximum ${n[n.length-1]} and the 95th percentile is ${o}).`},Wp={line:0,column:0},Gp=`Failed to recover the initial state from its fingerprint.`,Kp=`Failed to recover the next state from its fingerprint.`,qp=e=>({kind:`Identifier`,name:e,location:Wp}),Jp=/* @__PURE__ */ new Set([`name`,`property`]),Yp=(e,t,n)=>{let r=Wa(t,n);if(!r)throw new d(`The ${e} ${t} specified in the configuration file\nis not defined in the specification.`);if(r.kind===`Operator`&&r.params.length>0)throw new d(Jp.has(e)?`TLC requires ${t} not to take any argument.`:`TLC requires ${e} not to take any argument, but one was given: ${t}`);return r},Xp=(e,t,n)=>{let r=Yp(e,t,n);if(Ka(r,n))throw new d(`The ${e} ${t} cannot be a constant.`);return r},Zp=(e,t,n)=>{if(Ka(t,n)&&t.body.kind!==`Number`&&t.body.kind!==`String`)try{return X(qp(e),hm(n,void 0,void 0))}catch(e){if(e instanceof f)return;throw e}},Qp=(e,t,n)=>{let r=Yp(e,t,n),i=Zp(t,r,n);if(i!==void 0&&i!==!0)throw new d(`The ${e} of ${t} is equal to ${H(i)}`);return i===void 0?r:void 0},$p=(e,t)=>{let n=yd({constants:new Set(t.constants.keys()),variables:new Set(t.variables),getDefinition:e=>Wa(e,t)});return e.flatMap(e=>{let r=Qp(`invariant`,e,t);if(!r)return[];let i=n.analyzeDefinition(r,/* @__PURE__ */ new Map);if(i.level>=2)throw new d(`The invariant ${e} is not a state predicate (one with no primes or temporal operators).${i.params.size===0?``:`
+Note that a bug can cause TLC to incorrectly report this error.
+If you believe your TLA+ or PlusCal specification to be correct,
+please check if this bug described in LevelNode.java starting at line 590ff affects you.`}`);return[{name:e,expression:qp(e),scope:void 0}]})},em=(e,t)=>{if(!k(e))return;let n=V(e);if(!n.domain.every(e=>typeof e==`string`))return;let r=n.domain.map((e,t)=>[String(e),n.range[t]]);return Object.fromEntries(r.sort((e,n)=>t.indexOf(e[0])-t.indexOf(n[0])))},tm=(e,t)=>{if(e.kind===`And`)return e.operands.flatMap(e=>tm(e,t));if(e.kind===`Identifier`&&!t.constants.has(e.name)){let n=Wa(e.name,t);if(n?.kind===`Operator`&&n.params.length===0)return tm(n.body,t)}return[e]},nm=(e,t,n)=>{let r=e.expression;if(r.kind!==`Identifier`||$(r,e.scope,t)>0)return!1;let i=X(r,hm(t,void 0,void 0,e.scope));if(i===!1)throw new d(`The spec is trivially false because ${r.name} is false.`);if(i!==!0)throw new d(`The operator ${r.name}, which equals ${H(i)},\ncannot be used as a ${n}`);return!0},rm=(t,n)=>{if(t.specification===void 0){let e=(e,t)=>{if(e===void 0)return;let r=Yp(t,e,n).body,i=qp(e);if(r.kind!==`Number`&&r.kind!==`String`&&$(i,void 0,n)===0)throw new d(`The ${t} ${e} cannot be a constant.`);return i};return{init:e(t.init,`initial predicate`),next:e(t.next,`next state action`),scope:void 0,temporals:[]}}let r=[],i=[],o=[],s=Yp(`name`,t.specification,n),c=Zp(t.specification,s,n);if(c!==void 0)throw new d(`The value of ${t.specification} is equal to ${H(c)}`);if(bf(s.body,void 0,n,!1).forEach(s=>{let c=s.expression;if(nm(s,n,`spec`))return;if(c.kind===`UnboundedQuantifier`&&c.isTemporal)throw a(new d(`TLC does not support temporal existential, nor universal, quantification over state variables.`),e.error);if(c.kind===`Always`&&c.expression.kind===`BoxAction`){i.push({expression:c.expression.action,scope:s.scope});return}if(c.kind===`Always`&&$(c.expression,s.scope,n)<2)throw new d(`TLC cannot handle []P in the specification ${t.specification} when P is a state predicate`);let l=$(c,s.scope,n);if(l===3)o.push(s);else{if(l===2)throw new d(`TLC cannot handle the action-level conjunct of the specification ${t.specification}`);r.push(s)}}),i.length>1)throw new d(`The specification ${t.specification} must contain at most one [][Next]_vars`);let l=[...r,...i],u=e=>`$specification${e}`,f=l.reduce((e,t,n)=>t.scope===void 0?e:{name:u(n),binding:{kind:`Thunk`,expression:t.expression,scope:t.scope,state:void 0,next:void 0,cache:void 0},parent:e},void 0),p=(e,t)=>e.scope===void 0?e.expression:{kind:`Identifier`,name:u(t),location:e.expression.location,resolution:{kind:`Local`}};return{init:r.length===0?void 0:{kind:`And`,operands:r.map(p),location:Wp},next:i.length===0?void 0:p(i[0],r.length),scope:f,temporals:o}},im=(e,t)=>{let n={initialPredicates:[],invariants:[],actionProperties:[],liveness:[]};return e.properties.forEach(e=>{let r=Qp(`property`,e,t);r&&bf(r.body,void 0,t,!0).forEach(r=>{let i=r.expression;if(nm(r,t,`property`))return;if(i.kind===`Always`&&i.expression.kind===`BoxAction`){n.actionProperties.push({name:e,box:i.expression,action:i.expression.action,subscript:i.expression.subscript,scope:r.scope});return}if(i.kind===`Always`&&$(i.expression,r.scope,t)<=1){n.invariants.push({name:e,expression:i.expression,scope:r.scope});return}let a=$(i,r.scope,t);if(a<2)n.initialPredicates.push({name:e,expression:i,scope:r.scope});else{if(a===2)throw new d(`The property ${e} is an action-level formula`);n.liveness.push({name:e,expression:i,scope:r.scope})}})}),n},am=(e,t,n)=>t.flatMap(t=>Qp(e,t,n)?[{name:t,expression:qp(t),scope:void 0}]:[]),om=(e,t)=>{let n=Wa(e,t);return n?.kind===`Operator`?n.bodyRange:void 0},sm=(e,t)=>e.map((n,r)=>{if(e.indexOf(n)!==r)throw new d(`_POSSIBLE lists ${n} more than once`);Xp(`possible`,n,t);let i=qp(n);if($(i,void 0,t)===3)throw new d(`The possible of ${n} is equal to a temporal formula; only state- and action-level predicates are supported`);return{name:n,expression:i,scope:void 0}}),cm=(e,t)=>e.flatMap(e=>tm(e.expression,t).map(n=>({name:e.name,expression:n,scope:e.scope,variables:bs(n,t)}))),lm=(e,t,n)=>{let r=e.variables;if(!n||!r)return!1;for(let e=0;e<r.length;e++)if(t[r[e]]!==n[r[e]])return!1;return!0},um=/[\u0100-\uffff]/,dm=/* @__PURE__ */ new Set([`JsonDeserialize`,`ndJsonDeserialize`]),fm=e=>e.kind===`String`?um.test(e.value):e.kind===`Set`&&e.elements.some(fm),pm=e=>e.kind===`String`&&um.test(e.value)||e.kind===`Apply`&&dm.has(e.operator)||Ua(e).some(pm),mm=(e,t)=>e.constants.some(e=>fm(e.value)||(e.args??[]).some(fm))||[...t.definitions.values()].some(e=>pm(e.body)||e.kind===`Function`&&e.bounds.some(e=>pm(e.set))),hm=(e,t,n,r)=>({environment:e,scope:r,state:t,next:n}),gm=(e,t,n)=>Ha(X(e,t),n),_m=(e,t,n=vm)=>{let r=X(e,t);if(typeof r!=`boolean`)throw new f(n(e,t.environment));return r},vm=(e,t)=>{let n=e.kind===`Identifier`?Wa(e.name,t):void 0,r=n?.kind===`Operator`?n.body:e,i=n?.kind===`Operator`?n.bodyRange:void 0;return`TLC expected a boolean value, but did not find one. ${r.kind===`Number`?r.text??String(r.value):i?ka(i):Aa(r)}`},ym=()=>{},bm=(e,t,n)=>e.forEach(e=>{let r=t.possibleCounts.get(e.name)??0,i=gm(e.expression,n,`_POSSIBLE ${e.name}`);t.possibleCounts.set(e.name,i?r+1:r)}),xm=(e,t,n)=>{try{return gm(e,hm(t,void 0,void 0),n)?void 0:{message:void 0}}catch(e){if(e instanceof f)return{message:e.message};throw e}},Sm=(e,t)=>{for(let n of e.filter(e=>!e.isAxiom)){let e=xm(n.expression,t,`an assumption`);if(e)return{name:Aa(n.expression),trace:[],message:e.message}}},Cm=(t,n,r)=>{let i=$p(t.invariants,n),o=rm(t,n),s=im(t,n),c=cm([...i,...s.invariants],n),l=c.length>0||s.actionProperties.length>0||s.liveness.length>0;if(o.init===void 0&&(l||s.initialPredicates.length>0||n.variables.length>0))throw new d(`The configuration file did not specify the initial state predicate.`);if(o.next===void 0&&l)throw new d(`The configuration file did not specify the next state predicate.`);let u=cm(am(`constraint`,t.constraints,n),n),f=am(`action constraint`,t.actionConstraints,n);t.rlReward!==void 0&&Yp(`rlreward`,t.rlReward,n),t.periodic!==void 0&&Yp(`periodic`,t.periodic,n);let p=sm(t.possible,n);if(n.variables.length===0)return;let m=t.symmetry===void 0?[]:cp(t.symmetry,n);t.view!==void 0&&Yp(`view function`,t.view,n);let h=t.view===void 0?void 0:{name:t.view,expression:qp(t.view),scope:void 0},g=s.actionProperties.map(e=>{let t={kind:`Unchanged`,expression:e.subscript,location:Wp};return{...e,unchanged:t}}),_=e=>$(e.expression,void 0,n)>=2,v=p.filter(e=>!_(e)),y=p.filter(_),b=n.runtime,x={indices:void 0},S=()=>{if(x.indices)return x.indices;let e=r(),t=t=>{let r=e.indexOf(n.variables[t]);return r===-1?n.variables.length:r};return x.indices=n.variables.map((e,t)=>t).sort((e,n)=>t(e)-t(n)),x.indices},ee=m.length>0?S():void 0,C=(e,t)=>X(e,hm(n,t,void 0)),w=e=>{let t=S(),n=m.length===0?e:gp(e,m,t);return pc(h===void 0?t.map(e=>n[e]):[C(h.expression,n)])},T=mm(t,n);b.getFingerprint=w;let te=()=>{let e=p.find(e=>!b.possibleCounts.get(e.name));if(!e)return;let t=om(e.name,n),r=t?` at ${ka(t)}`:``;return{name:e.name,message:`The _POSSIBLE predicate ${e.name}${r} was never witnessed.\nOthers may be unwitnessed too; only witnessed predicates appear with a\nnon-zero count in the record printed above.\nSee https://explain.tlapl.us/possible-conditions for additional details.`,counts:pe(H(Mc(b),!0))}};return{properties:s,spec:o,isSymmetric:m.length>0,getTlcOrder:S,getStoredFingerprints:(e,t)=>{if(h!==void 0||T)return BigInt64Array.from(e,w);let n=S(),r=gc();return BigInt64Array.from(t,e=>r(n.map(t=>e[t])))},getFingerprintState:e=>{if(T)return[String(w(e))];let t=m.length===0?e:gp(e,m,ee);return h===void 0?t:[C(h.expression,t)]},findViolatedInvariant:(t,r)=>c.find(i=>{if(lm(i,t,r))return!1;try{return!_m(i.expression,hm(n,t,void 0,i.scope))}catch(t){throw r?wm(a(t,e.safetyEvaluationFailure),`Evaluating invariant ${i.name} failed.`):t}}),satisfiesConstraints:(e,t)=>u.every(r=>lm(r,e,t)||_m(r.expression,hm(n,e,void 0))),findFailedInitialPredicate:e=>s.initialPredicates.find(t=>!_m(t.expression,hm(n,e,void 0,t.scope))),findViolatedActionProperty:(e,t)=>g.find(r=>{try{return!_m(r.action,hm(n,e,t,r.scope),()=>`Attempted to evaluate an expression of form [A]_e, but A was not a boolean.\n${Aa(r.box)}`)&&!gm(r.unchanged,hm(n,e,t,r.scope),`a subscript`)}catch(e){throw wm(e,`Evaluating action property ${r.name} failed.`)}}),satisfiesActionConstraints:(e,t)=>f.every(r=>_m(r.expression,hm(n,e,t),e=>`TLC threw an unexpected exception.\nThis was probably caused by an error in the spec or model.\nSee the User Output or TLC Console for clues to what happened.\nThe exception was a java.lang.RuntimeException\n: ${vm(e,n)}`)),trackStatePossible:v.length===0?ym:e=>bm(v,b,hm(n,e,void 0)),trackActionPossible:y.length===0?ym:(e,t)=>bm(y,b,hm(n,e,t)),findUnwitnessedPossible:te,findPostconditionViolation:()=>{let e=te();if(e)return e;for(let e of t.postconditions){let t=xm(qp(e),n,`a postcondition`);if(t)return{name:e,message:t.message??`Postcondition ${e} is false.`}}}}},wm=(e,t)=>e instanceof f?a(new f(`${t}\n${e.message}`,e),h(e)):e,Tm=e=>{i(!1);let t=typeof e.config==`string`?se(e.config):e.config,n=e.onPrint??console.log,r={isMuted:!1},a=e=>{r.isMuted||n(e)},o=e=>{r.isMuted=!0;let t=e();return r.isMuted=!1,t};De(Pp(e.source,t,e.loadModule));let s=Nd(t,{source:e.source,loadModule:e.loadModule,loadClass:e.loadClass,print:a,files:{readFile:e.readFile,writeFile:e.writeFile},seed:e.seed}),l=s.environment,u=l.runtime;u.pause=e.onPause??(()=>{}),u.getSpecification=()=>ip(t,l,s.variableLocations,s.instanceActions);let m={depth:0},g=(e,t,n)=>({status:e,violation:t&&{...t,loopStart:t.loopStart},failure:n,generatedStates:u.generatedStates,distinctStates:u.distinctStates,queuedStates:u.queueSize,depth:u.generatedStates===0?0:Math.max(m.depth,1),outDegrees:void 0,fingerprintDistance:void 0}),_=Array.from({length:32},()=>0),v={newStates:0},y=()=>Math.min(v.newStates,31),b=()=>_.map((e,t)=>t===y()?e+1:e),x=()=>({...g(`success`),outDegrees:[..._],fingerprintDistance:Hp(u.distinctStates,u.generatedStates,()=>S?S.getStoredFingerprints(D,ae):BigInt64Array.from(D,u.getFingerprint))}),S=Cm(t,l,()=>Np(e.source,e.loadModule)),ee=Sm(s.assumptions,l);if(ee)return g(`assumption-violation`,ee);if(!S)return x();let C=t.postconditions.length>0||t.possible.length>0,w=(e,t,n)=>{if(C){let e=t.loopStart;u.counterExample=Fl(t.trace,e===void 0||!n?void 0:{start:e,action:n()})}let r=S.findUnwitnessedPossible();return r||S.findPostconditionViolation(),g(e,r?{...t,unwitnessed:r}:t)},T=S.spec,te=S.getFingerprintState,E={value:void 0},ne=t.view!==void 0||t.symmetry!==void 0,re=c(()=>Nf(S.properties.liveness,T.temporals,l)),ie=S.isSymmetric||re!==void 0,D=[],ae=[],oe=[],ce=[],le=[],ue=/* @__PURE__ */ new Map,de=On(),fe=e=>Object.fromEntries(S.getTlcOrder().map(t=>[l.variables[t],e[t]])),pe=(e,t,n,r)=>{let i=t[n].state,a=(t[n+1]??t[r??n]).state;u.getLevel=()=>n+1,u.getBehavior=()=>t.slice(0,n+1).map(e=>e.state);try{let t=Xp(`alias`,e,l).body,n=X(qp(e),hm(l,i,a)),r=t.kind===`Record`?t.fields.map(e=>e.name):[];return em(n,r)??fe(i)}catch(e){if(!(e instanceof d||e instanceof f))throw e;return{...fe(i),_ALIASEvalError:e.message}}},O=(e,n,r)=>{E.value??=np(t,l,s.instanceActions);let i={...M};Object.assign(M,{index:e,isExpanding:!0,candidate:void 0});let a=te(r),o=E.value.find(e=>Oa(e.expression,n,l,e.scope).some(e=>Se(te(e.state),a)));return Object.assign(M,i),o&&rp(o)},k=(e,n,r)=>{let i=t.alias,a=o(()=>(e.length>1&&Fo(l)&&A(),e.map((t,r)=>r===0||t.action===`Stuttering`?void 0:O(n[r-1],e[r-1].state,t.state))));return e.map((t,n)=>({action:t.action,label:a[n],state:i===void 0?fe(t.state):pe(i,e,n,r)}))},A=()=>T.init===void 0?[]:Ea(T.init,l,T.scope),me=e=>T.next===void 0?[]:Oa(T.next,e,l,T.scope),he=(e,t)=>Se(te(e),ae[t]),ge=(e,t)=>me(e).find(e=>he(e.state,t)),_e=(e,t)=>{let n=ne||Fo(l)?A().find(t=>he(t,e[0])):D[e[0]];if(!n)throw new f(Gp);let r=[{state:n,action:void 0}];for(let n=1;n<e.length;n++){let i=r[n-1].state;if(e[n-1]===e[n]){r.push({state:i,action:`Stuttering`});continue}let a=ge(i,e[n]);if(!a)throw new f(t);r.push(a)}return r},j=(e,t)=>{let n=[];for(let t=e;t!==-1;t=oe[t])n.unshift(t);let r=ne&&n.length>1?_e(n,Gp):n.map(e=>({state:D[e],action:ce[e]}));if(!t)return k(r,n);let i=ne?me(D[e]).find(e=>Se(e.state,t.state))?.action:t.action;return k([...r,{state:t.state,action:i}],n)},ve=e=>oe[e]===-1?[{action:void 0,label:void 0,state:fe(D[e])}]:j(e),ye=(e,t,n,r)=>{if(!(e instanceof f))throw e;return{...g(`error`,void 0,{message:e.message,trace:t,initialState:n&&!(e instanceof p)?fe(n):void 0,exitCode:h(e)}),outDegrees:r}},be=(e,t)=>{let n=_e(e,Kp),r=n[n.length-1].state;if(ne&&t!==void 0&&t!==e.length-1&&ge(r,e[t])===void 0)throw new f(Kp);return k(n,e,t)},xe=e=>{let t=2166136261;for(let n=0;n<e.length;n++)t=an(t,un(e[n]));return t&1073741823},Se=(e,t)=>{for(let n=0;n<t.length;n++)if(!Be(e[n],t[n]))return!1;return!0},Ce=(e,t)=>{let n=ue.get(e);return n===void 0?-1:typeof n==`number`?Se(ae[n],t)?n:-1:n.find(e=>Se(ae[e],t))??-1},we=(e,t)=>{let n=ue.get(e);n===void 0?ue.set(e,t):typeof n==`number`?ue.set(e,[n,t]):n.push(t)},Te=e=>{u.distinctStates=D.length+1,m.depth=Math.max(m.depth,e),u.diameter=Math.max(u.diameter,e)},Ee=(e,t,n,r)=>{let i=n===-1?1:le[n]+1;D.push(e),ae.push(t),oe.push(n),ce.push(r),le.push(i)},M={index:-1,isExpanding:!1,candidate:void 0,candidateLevel:0,livenessSource:-1},Oe=e=>e===-1?[]:[...Oe(oe[e]),D[e]];u.isSeen=e=>{let t=te(e);return Ce(xe(t),t)!==-1},u.getBehavior=e=>{let t=e===M.candidate?-1:D.indexOf(e);return t===-1?[...Oe(M.index),e]:Oe(t)},u.getCurrentState=()=>M.index===-1?void 0:D[M.index],u.setLivenessSource=e=>{M.livenessSource=e},u.getLevel=e=>{let t=M.livenessSource;return t===-1?e===M.candidate?M.candidateLevel:M.index===-1?0:e===D[M.index]?le[M.index]:M.isExpanding?le[M.index]+1:0:e===D[t]?le[t]:le[t]+1};let ke=e=>{de(e),u.generatedStates++,u.initialStates++,M.candidate=e,M.candidateLevel=1;let t=te(e),n=xe(t),r=S.satisfiesConstraints(e);if(r&&S.trackStatePossible(e),r&&Ce(n,t)!==-1)return;r&&(Te(1),u.queueSize++,re?.addInitialState(D.length,e));let i=S.findViolatedInvariant(e);if(i)return w(`invariant-violation`,{name:i.name,trace:k([{action:void 0,state:e}],[])});let a=S.findFailedInitialPredicate(e);if(a)return w(`liveness-violation`,{name:a.name,trace:k([{action:void 0,state:e}],[])});r&&(we(n,D.length),Ee(e,t,-1,void 0))},Ae=(e,t,n)=>{let r=D[e];u.generatedStates++,M.candidate=t.state,M.candidateLevel=le[e]+1,ie&&de(t.state);let i=te(t.state),a=xe(i),o=Ce(a,i),s=S.satisfiesConstraints(t.state,r);s&&S.trackStatePossible(t.state);let c=s&&S.satisfiesActionConstraints(r,t.state);c&&S.trackActionPossible(r,t.state);let l=c?o:-1;if(l!==-1&&re){let e=D[l],r=e.every((e,n)=>e===t.state[n]);n.push({index:l,state:r?e:t.state})}let d=c&&l===-1;if(d&&(Te(le[e]+1),v.newStates++),l===-1)try{let n=S.findViolatedInvariant(t.state,r);if(n)return w(`invariant-violation`,{name:n.name,trace:j(e,t)})}catch(n){return ye(n,j(e,t),void 0,b())}let f=S.findViolatedActionProperty(r,t.state);if(f)return w(`liveness-violation`,{name:f.name,trace:j(e,t)});d&&(ie||de(t.state),we(a,D.length),re&&n.push({index:D.length,state:t.state}),Ee(t.state,i,e,t.action),u.queueSize++)},N={result:void 0};if(T.init!==void 0)try{Ta(T.init,l,e=>{try{N.result=ke(e)}catch(t){N.result=ye(t,[],e)}return N.result!==void 0},T.scope)}catch(e){return ye(e,[])}if(N.result)return N.result;let je=T.next;if(je===void 0){if(D.length>0)throw new f(`No next state actions defined to generate successor states from.`);return x()}let Me=e=>{let n=D[e],r=[],i=Da(je,n,l,t=>{try{N.result=Ae(e,t,r)}catch(n){N.result=ye(n,j(e,t))}return N.result!==void 0},T.scope);if(M.isExpanding=!1,N.result)return N.result;if(i===0&&t.checkDeadlock)return w(`deadlock`,{name:`deadlock`,trace:ve(e)});try{let t=re?.addState(e,n,r);return M.livenessSource=-1,t?w(`property-violation`,{name:t.name,trace:be(t.path)}):void 0}catch(t){return ye(t,ve(e),void 0,b())}},Ne=e=>{let t=[...e.prefix,...e.cycle],n=be(t,e.prefix.length),r=t[e.prefix.length],i=t[t.length-1],a=r===i?void 0:o(()=>O(i,D[i],D[r]));return w(`liveness-violation`,{name:e.name,trace:n,loopStart:e.prefix.length,loopLabel:a},()=>r===i?n[n.length-1].action:me(D[i]).find(e=>Se(e.state,D[r]))?.action)},Pe=re!==void 0&&e.livenessCheck!==`final`,P=performance.now(),Fe={at:P+3e3,size:1,time:0},Ie=e=>{let t=performance.now();if(Fe.at=t+6e4,!((e-Fe.size)/Fe.size>.1)||Fe.time>(t-P)*.2)return;Fe.size=e;let n=re?.findViolation();return M.livenessSource=-1,Fe.time+=performance.now()-t,n};i(!0);for(let e=0;e<D.length&&!u.isStopped;e++){M.index=e,M.candidate=void 0,u.queueSize=D.length-e-1,M.isExpanding=!0;try{N.result=Me(e)}catch(t){N.result=ye(t,ve(e))}if(N.result)return N.result;if(_[y()]++,v.newStates=0,Pe&&performance.now()>=Fe.at){let t=Ie(e+1);if(t)return Ne(t)}}M.index=-1,M.candidate=void 0;let Le=re?.findViolation();if(M.livenessSource=-1,Le)return Ne(Le);let F=S.findPostconditionViolation();return F?g(`postcondition-violation`,{...F,trace:[]}):x()},Em=e=>{let t=Math.imul(e^e>>>16,2146121005),n=Math.imul(t^t>>>15,2221713035);return n^n>>>16},Dm=(e,t)=>{let n=2166136261,r=1779033703;for(let t=0;t<e.length;t++)n=Math.imul(n^un(e[t]),16777619),r=Math.imul(r^_n(e[t]),1540483477);t[0]=Em(n)||1,t[1]=Em(r)},Om=(e,t)=>(e>>>0)%t,km=()=>{let e={slots:/* @__PURE__ */ new Int32Array(8192),used:0},t=(e,t,n)=>{let r=e.length/2-1;for(let i=t&r;;i=i+1&r){let r=e[i*2];if(r===0&&e[i*2+1]===0||r===t&&e[i*2+1]===n)return i}},n=()=>{let n=e.slots,r=new Int32Array(n.length*2);for(let e=0;e<n.length;e+=2){if(n[e]===0)continue;let i=t(r,n[e],n[e+1]);r[i*2]=n[e],r[i*2+1]=n[e+1]}e.slots=r};return{insert:(r,i)=>{e.used*4>=e.slots.length&&n();let a=t(e.slots,r,i);return e.slots[a*2]!==r&&(e.slots[a*2]=r,e.slots[a*2+1]=i,e.used++,!0)},remove:(n,r)=>{let i=t(e.slots,n,r);e.slots[i*2]===n&&(e.slots[i*2]=0,e.slots[i*2+1]=1)}}},Am=()=>{let e={words:/* @__PURE__ */ new Int32Array(1024),length:0,count:0},t=[],n=/* @__PURE__ */ new Map,r=t=>{if(e.length===e.words.length){let t=new Int32Array(e.words.length*2);t.set(e.words),e.words=t}e.words[e.length++]=t},i=e=>{let i=n.get(e);if(i!==void 0)return r(i);n.set(e,t.length),r(t.length),t.push(e)},a=e=>typeof e==`boolean`?(r(+!!e),!0):typeof e==`number`?(e|0)===e&&(r(2),r(e),!0):typeof e==`string`?(r(3),i(e),!0):e.kind===`ModelValue`?(r(4),i(e.name),!0):e.kind===`Set`?(r(5),r(e.elements.length),e.elements.every(a)):e.kind===`Function`&&(r(6),r(e.domain.length),e.domain.every(a)&&e.range.every(a));return{encode:t=>{let n=e.length;return t.every(a)?(e.count++,!0):(e.length=n,!1)},finish:()=>({words:e.words.slice(0,e.length),strings:t,count:e.count})}},jm=e=>t=>{let n=t.words,r={index:0},i=e=>Array.from({length:e},()=>a()),a=()=>{let e=n[r.index++];if(e===0)return!1;if(e===1)return!0;if(e===2)return n[r.index++];if(e===3)return t.strings[n[r.index++]];if(e===4)return Ie(t.strings[n[r.index++]]);let a=n[r.index++];if(e===5)return Le(i(a));let o=i(a);return F(o,i(a))};return Array.from({length:t.count},()=>Array.from({length:e},()=>a()))};Object.defineProperty(exports,"A",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"C",{enumerable:!0,get:function(){return Oe}}),Object.defineProperty(exports,"D",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"E",{enumerable:!0,get:function(){return se}}),Object.defineProperty(exports,"M",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"N",{enumerable:!0,get:function(){return e}}),Object.defineProperty(exports,"O",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"S",{enumerable:!0,get:function(){return H}}),Object.defineProperty(exports,"T",{enumerable:!0,get:function(){return pe}}),Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return Zs}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return Dm}}),Object.defineProperty(exports,"b",{enumerable:!0,get:function(){return Oa}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Sm}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return Hp}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return Fp}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return Nd}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return Np}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Om}}),Object.defineProperty(exports,"j",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"k",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return zp}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return Pp}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return Am}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Tm}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return Up}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return km}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return Cm}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return jm}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Vp}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return Fo}}),Object.defineProperty(exports,"w",{enumerable:!0,get:function(){return De}}),Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return On}}),Object.defineProperty(exports,"y",{enumerable:!0,get:function(){return Ea}});