tla-ts 0.0.2 → 0.0.3-dev.a50fc89

package/dist/run-cli.cjs

@@ -6,5 +6,23 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-const e=require("./transfer.cjs"),t=require("./parallel.cjs");let n=require("node:fs"),r=require("node:path"),i=require("node:os");const a={success:e.N.success,"assumption-violation":e.N.assumptionViolation,deadlock:e.N.deadlock,"invariant-violation":e.N.safetyViolation,"property-violation":e.N.safetyViolation,"liveness-violation":e.N.livenessViolation,"postcondition-violation":e.N.assumptionViolation,error:e.N.error},o=e=>/^[+-]?\d+$/.test(e)&&BigInt.asIntN(64,BigInt(e))===BigInt(e),s=e=>{let t=e.indexOf(`-workers`);if(t===-1)return 1;let n=e[t+1];return n===`auto`?(0,i.availableParallelism)():Math.max(1,Number.parseInt(n,10)||1)},c=t=>{let n=Object.entries(t);n.forEach(([t,r])=>console.log(`${n.length===1?``:`/\\ `}${t} = ${e.T(e.S(r))}`)),console.log(``)},l=(e,t=`Error: The behavior up to this point is:`)=>{e.length>0&&console.log(t),e.forEach((e,t)=>{console.log(`State ${t+1}: <${e.label??e.action??`Initial predicate`}>`),c(e.state)})},u=t=>{if(t.failure)console.log(`Error: ${t.failure.message}`),t.failure.initialState&&(console.log(`While working on the initial state:`),c(t.failure.initialState)),l(t.failure.trace);else if(t.violation){let e=t.violation,n=e.name,r=e.loopStart,i=r===void 0&&e.trace.length===1&&(t.status===`invariant-violation`||t.status===`liveness-violation`),a={success:``,error:``,"assumption-violation":e.message?`Error: Evaluating assumption ${n} failed.\n${e.message}`:`Error: Assumption ${n} is false.`,deadlock:`Error: Deadlock reached.`,"invariant-violation":i?`Error: Invariant ${n} is violated by the initial state:`:`Error: Invariant ${n} is violated.`,"property-violation":`Error: Property ${n} is violated.`,"liveness-violation":r===void 0?i?`Error: Property ${n} is violated by the initial state:`:`Error: Action property ${n} is violated.`:`Error: Temporal property ${n} was violated.\n`,"postcondition-violation":`Error: ${e.message??`Postcondition ${n} is false.`}`}[t.status];if(e.counts&&console.log(e.counts),console.log(a),i)c(e.trace[0].state);else if(r===void 0)l(e.trace);else{l(e.trace,`Error: The following behavior constitutes a counter-example:
-`);let t=r===e.trace.length-1;console.log(t?`State ${r+2}: Stuttering`:`Back to state ${r+1}${e.loopLabel?`: <${e.loopLabel}>\n`:``}`)}let o=e.unwitnessed;if(o?.counts&&console.log(o.counts),o&&console.log(`Error: ${o.message}`),i||t.status===`assumption-violation`)return}else{let n=e.f(t.distinctStates,t.generatedStates);if(console.log(`Model checking completed. No error has been found.`),console.log(`  Estimates of the probability that TLC did not check all reachable states`),console.log(`  because two distinct states had the same fingerprint:`),console.log(`  calculated (optimistic):  val = ${e.l(n)}`),t.fingerprintDistance!==void 0){let n=e.u(t.fingerprintDistance);console.log(`  based on the actual fingerprints:  val = ${e.l(n)}`)}}console.log(`${t.generatedStates} states generated, ${t.distinctStates} distinct states found, ${t.queuedStates} states left on queue.`),console.log(`The depth of the complete state graph search is ${t.depth}.`);let n=t.outDegrees&&e.p(t.outDegrees);n&&console.log(n)},d=async i=>{let c=i.find((e,t)=>e.endsWith(`.tla`)&&i[t-1]!==`-config`);if(!c)return console.error(`Usage: tla-ts <Spec.tla> [-config <Spec.cfg>] [-deadlock] [-lncheck <final|default>] [-seed <num>] [-workers <count|auto>]`),1;if(!(0,n.existsSync)(c))return console.error(`Cannot find the specification file ${c}`),e.N.configParseError;let l=i.indexOf(`-config`),d=l===-1?c.replace(/\.tla$/,`.cfg`):i[l+1];if(!d||!(0,n.existsSync)(d))return console.error(`Cannot find the configuration file ${d??``}`),e.N.configParseError;let f=e.E((0,n.readFileSync)(d,`utf8`));i.includes(`-deadlock`)&&(f.checkDeadlock=!1);let p=i.indexOf(`-seed`),m=p===-1?`0`:i[p+1];if(m===void 0)return console.error(`Error: seed required.`),1;if(!o(m))return console.error(`Error: An integer for seed required. But encountered ${m}`),1;let h=i.indexOf(`-lncheck`),g=h===-1?`default`:i[h+1]?.toLowerCase();if(g===void 0)return console.error(`Error: expect a strategy such as final for -lncheck option.`),1;let _=(0,r.dirname)(c);console.log(`Checking ${(0,r.basename)(c)} with ${(0,r.basename)(d)}`);let v=await t.t({workers:s(i),livenessCheck:[`final`,`seqfinal`,`off`].includes(g)?`final`:`default`,seed:BigInt(m),source:(0,n.readFileSync)(c,`utf8`),config:f,onPause:()=>(0,n.readSync)(0,Buffer.alloc(1)),loadModule:e=>{let t=(0,r.join)(_,`${e}.tla`);return(0,n.existsSync)(t)?(0,n.readFileSync)(t,`utf8`):void 0},loadClass:e=>{let t=(0,r.join)(_,`${e}.class`);return(0,n.existsSync)(t)?(0,n.readFileSync)(t):void 0},readFile:e=>(0,n.existsSync)(e)?(0,n.readFileSync)(e,`utf8`):void 0,writeFile:(e,t)=>{(0,n.mkdirSync)((0,r.dirname)((0,r.resolve)(e)),{recursive:!0}),(0,n.writeFileSync)(e,t)}});return u(v),v.failure?.exitCode??a[v.status]},f=t=>{if(t instanceof e.D||t instanceof e.k)return console.log(`Error: ${t.message}`);console.error(`${t.name}: ${t.message}`)},p=async()=>{try{process.exitCode=await d(process.argv.slice(2))}catch(t){if(!(t instanceof e.O))throw t;f(t),process.exitCode=e.M(t)}};exports.runCli=p;
+const e=require("./transfer.cjs"),t=require("./parallel.cjs");let n=require("node:fs"),r=require("node:child_process"),i=require("node:path"),a=require("node:os");const o=e=>{let t=e.isRequired?e.flag:`[${e.flag}]`;return e.isRepeatable?`${t}...`:t},s=(e,t)=>{let n=new Map(t.map(e=>{let[t,...n]=e.flag.split(` `);return[t,n.length]}));return{usage:e.replace(`{options}`,t.map(o).join(` `)),parse:e=>{let t=[],r=[],i=[];for(let a=0;a<e.length;a++){let o=n.get(e[a]);o===void 0?(e[a].startsWith(`-`)?i:r).push(e[a]):(t.push({name:e[a],values:e.slice(a+1,a+1+o)}),a+=o)}return{options:t,positionals:r,unknown:i,incomplete:t.find(e=>e.values.length<(n.get(e.name)??0)),has:e=>t.some(t=>t.name===e),get:e=>t.findLast(t=>t.name===e)?.values}}}},c=e=>{let t=e.endColumn-1;return e.startLine===e.endLine?e.startColumn>=t?`line ${e.startLine}, character ${e.startColumn}`:`line ${e.startLine}, characters ${e.startColumn}-${t}`:`line ${e.startLine}, character ${e.startColumn} to line ${e.endLine}, character ${t}`},l=e=>`File ${JSON.stringify(e.file)}, ${c(e)}`,u=e=>`${e?l(e):`<unknown location>`}:\n`,d=(e,t)=>({text:`${u(e)}Error: ${t}`,channel:`stderr`}),f=e=>e?`${l(e)} :\n`:``,p=e=>({kind:`Shift`,amount:e}),m=(e,t)=>({kind:`Cons`,expression:e,rest:t}),h=(e,t)=>e.reduce((e,t)=>m(t,e),t),g=(e,t)=>t.kind===`Bump`?{kind:`Bump`,amount:t.amount+e,rest:t.rest}:{kind:`Bump`,amount:e,rest:t},_=(e,t)=>{let n=t.location?{...e,location:t.location}:e;return t.isAtomic?{...n,isAtomic:!0}:n},v=e=>{switch(e.kind){case`Fresh`:case`Flex`:return e.name;case`Defn`:return e.definition.name;case`Fact`:return}},y=(e,t,n)=>_({kind:`Apply`,operator:_({kind:`Internal`,builtin:e},n),args:t},n),b=e=>e.context.length===0?e.active:{kind:`Sequent`,sequent:e},x=(e,t)=>({hyp:t,rest:e,size:(e?.size??0)+1}),S=(e,t)=>t.reduce(x,e),C=e=>{let t=[];for(let n=e;n;n=n.rest)t.push(n.hyp);return t.reverse()},w=(e,t)=>{let n=0;for(let r=e;r;r=r.rest){if(v(r.hyp)===t)return{depth:n,hyp:r.hyp};n++}},T=(e,t)=>{let n=e;for(let e=0;e<t&&n;e++)n=n.rest;return n},E=(e,t,n)=>{let r=[];return[t.reduce((e,t)=>{let[i,a]=n(e,t);return r.push(a),i},e),r]},D=(e,t,n=0)=>({kind:`Fresh`,name:e,shape:n,level:t,domain:void 0,domainVisibility:`Visible`}),ee=(e,t)=>({kind:`Fresh`,name:e,shape:0,level:`Constant`,domain:t,domainVisibility:`Visible`}),te=(e,t,n)=>{switch(e.kind){case`Shift`:return _({kind:`Ix`,index:e.amount+t},n);case`Cons`:return t===1?_(k(e.expression),n):te(e.rest,t-1,n);case`Compose`:return M(e.outer,te(e.inner,t,n));case`Bump`:return t<=e.amount?_({kind:`Ix`,index:t},n):M(p(e.amount),te(e.rest,t-e.amount,n))}},O=(e,t)=>t.map(t=>M(e,t)),ne=(t,n)=>{if(t.kind===`Lambda`){if(t.params.length!==n.length)throw new e.M(`Arity mismatch`);return k(M(h(n,p(0)),t.body))}return t.kind===`Apply`?{kind:`Apply`,operator:t.operator,args:[...t.args,...n]}:n.length===0?k(t):{kind:`Apply`,operator:t,args:n}},k=e=>{if(!e.location&&!e.isAtomic)return e;let{location:t,isAtomic:n,...r}=e;return r},re=(e,t)=>[g(t.length,e),ue(t,t=>M(e,t))],A=(e,t)=>{switch(t.kind){case`Recursive`:case`Operator`:case`Bpragma`:return pe(t,t=>M(e,t));case`Instance`:{let n=g(t.instance.args.length,e);return{...t,instance:{...t.instance,substitutions:t.instance.substitutions.map(e=>({name:e.name,expression:M(n,e.expression)}))}}}}},ie=(e,t)=>{switch(t.kind){case`Fresh`:return t.domain?{...t,domain:M(e,t.domain)}:t;case`Flex`:return t;case`Defn`:return{...t,definition:A(e,t.definition)};case`Fact`:return{...t,expression:M(e,t.expression)}}},j=(e,t)=>{let[n,r]=E(e,t.context,(e,t)=>[g(1,e),ie(e,t)]);return{context:r,active:M(n,t.active)}},M=(e,t)=>{let n=t=>M(e,t);switch(t.kind){case`Internal`:case`Opaque`:case`String`:case`Num`:case`At`:return t;case`Ix`:return te(e,t.index,t);case`Apply`:return _(ne(n(t.operator),O(e,t.args)),t);case`Bang`:return{...t,expression:n(t.expression),selectors:t.selectors.map(e=>de(e,n))};case`Lambda`:return{...t,body:M(g(t.params.length,e),t.body)};case`Let`:{let[n,r]=E(e,t.definitions,(e,t)=>[g(1,e),A(e,t)]);return{...t,definitions:r,body:M(n,t.body)}}case`Sequent`:return{...t,sequent:j(e,t.sequent)};case`With`:return{...t,expression:n(t.expression)};case`If`:return{...t,condition:n(t.condition),consequent:n(t.consequent),alternative:n(t.alternative)};case`List`:return{...t,items:O(e,t.items)};case`Quant`:{let[n,r]=re(e,t.bounds);return{...t,bounds:r,body:M(n,t.body)}}case`Tquant`:return{...t,body:M(g(t.names.length,e),t.body)};case`Choose`:return{...t,domain:t.domain&&n(t.domain),body:M(g(1,e),t.body)};case`SetSt`:return{...t,domain:n(t.domain),body:M(g(1,e),t.body)};case`SetOf`:{let[n,r]=re(e,t.bounds);return{...t,bounds:r,element:M(n,t.element)}}case`SetEnum`:return{...t,elements:O(e,t.elements)};case`Arrow`:return{...t,domain:n(t.domain),range:n(t.range)};case`Fcn`:{let[n,r]=re(e,t.bounds);return{...t,bounds:r,body:M(n,t.body)}}case`FcnApp`:return{...t,function:n(t.function),args:O(e,t.args)};case`Product`:return{...t,factors:O(e,t.factors)};case`Tuple`:return{...t,elements:O(e,t.elements)};case`Rect`:case`Record`:return{...t,fields:t.fields.map(e=>({name:e.name,value:n(e.value)}))};case`Except`:return{...t,function:n(t.function),specs:fe(t.specs,n)};case`Dot`:return{...t,expression:n(t.expression)};case`Sub`:case`Tsub`:return{...t,action:n(t.action),subscript:n(t.subscript)};case`Fair`:return{...t,subscript:n(t.subscript),action:n(t.action)};case`Case`:return{...t,arms:t.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),other:t.other&&n(t.other)};case`Parens`:return{...t,expression:n(t.expression)}}},N=(e,t)=>e===0?t:M(p(e),t),P=(e,t,n)=>e.length===t.length&&e.every((e,r)=>n(e,t[r])),ae=(e,t)=>{let n=new Map(e.map(e=>[e.name,e.value])),r=new Map(t.map(e=>[e.name,e.value]));if(n.size!==r.size)return!1;for(let[e,t]of n){let n=r.get(e);if(!n||!I(t,n))return!1}return!0},oe=(e,t)=>e.level===t.level&&e.domain.kind===t.domain.kind&&(e.domain.kind!==`Domain`||t.domain.kind===`Domain`&&I(e.domain.expression,t.domain.expression)),se=(e,t)=>{if(e.kind!==t.kind)return!1;switch(e.kind){case`Number`:return t.kind===`Number`&&e.value===t.value;case`Instance`:return t.kind===`Instance`&&P(e.args,t.args,I);case`Label`:return t.kind===`Label`&&e.label===t.label&&P(e.args,t.args,I);default:return!0}},F=(e,t)=>{if(e.kind===`Operator`&&t.kind===`Operator`||e.kind===`Bpragma`&&t.kind===`Bpragma`)return I(e.body,t.body);if(e.kind===`Instance`&&t.kind===`Instance`){let n=e.instance.substitutions.map(e=>({name:e.name,value:e.expression})),r=t.instance.substitutions.map(e=>({name:e.name,value:e.expression}));return P(e.instance.args,t.instance.args,(e,t)=>e===t)&&e.instance.module===t.instance.module&&ae(n,r)}return!1},ce=(e,t)=>e.kind===`Fresh`&&t.kind===`Fresh`?e.level!==t.level||e.shape!==t.shape?!1:!e.domain||!t.domain?!e.domain&&!t.domain:I(e.domain,t.domain):e.kind===`Flex`&&t.kind===`Flex`?!0:e.kind===`Defn`&&t.kind===`Defn`?F(e.definition,t.definition)&&e.isLocal===t.isLocal:e.kind===`Fact`&&t.kind===`Fact`&&I(e.expression,t.expression),le=(e,t)=>P(e.context,t.context,ce)&&I(e.active,t.active),I=(e,t)=>{if(e.kind===`Parens`)return I(e.expression,t);if(t.kind===`Parens`)return I(e,t.expression);switch(e.kind){case`Ix`:return t.kind===`Ix`&&e.index===t.index;case`Opaque`:return t.kind===`Opaque`&&e.name===t.name;case`Internal`:return t.kind===`Internal`&&e.builtin===t.builtin;case`Lambda`:return t.kind===`Lambda`&&e.params.length===t.params.length&&I(e.body,t.body);case`Apply`:return t.kind===`Apply`&&I(e.operator,t.operator)&&P(e.args,t.args,I);case`Sequent`:return t.kind===`Sequent`&&le(e.sequent,t.sequent);case`Bang`:return t.kind===`Bang`&&I(e.expression,t.expression)&&P(e.selectors,t.selectors,se);case`With`:return t.kind===`With`&&I(e.expression,t.expression);case`Let`:return t.kind===`Let`&&P(e.definitions,t.definitions,F)&&I(e.body,t.body);case`If`:return t.kind===`If`&&I(e.condition,t.condition)&&I(e.consequent,t.consequent)&&I(e.alternative,t.alternative);case`List`:return t.kind===`List`&&e.bullet===t.bullet&&P(e.items,t.items,I);case`Quant`:return t.kind===`Quant`&&e.quantifier===t.quantifier&&P(e.bounds,t.bounds,oe)&&I(e.body,t.body);case`Tquant`:return t.kind===`Tquant`&&e.quantifier===t.quantifier&&P(e.names,t.names,(e,t)=>e===t)&&I(e.body,t.body);case`Choose`:return t.kind===`Choose`?e.domain&&t.domain?I(e.domain,t.domain)&&I(e.body,t.body):!e.domain&&!t.domain&&I(e.body,t.body):!1;case`SetSt`:return t.kind===`SetSt`&&I(e.domain,t.domain)&&I(e.body,t.body);case`SetOf`:return t.kind===`SetOf`&&I(e.element,t.element)&&P(e.bounds,t.bounds,oe);case`SetEnum`:return t.kind===`SetEnum`&&P(e.elements,t.elements,I);case`Arrow`:return t.kind===`Arrow`&&I(e.domain,t.domain)&&I(e.range,t.range);case`Fcn`:return t.kind===`Fcn`&&P(e.bounds,t.bounds,oe)&&I(e.body,t.body);case`FcnApp`:return t.kind===`FcnApp`&&P([e.function,...e.args],[t.function,...t.args],I);case`Tuple`:return t.kind===`Tuple`&&P(e.elements,t.elements,I);case`Product`:return t.kind===`Product`&&P(e.factors,t.factors,I);case`Rect`:return t.kind===`Rect`&&ae(e.fields,t.fields);case`Record`:return t.kind===`Record`&&ae(e.fields,t.fields);case`Except`:return t.kind===`Except`&&I(e.function,t.function)&&P(e.specs,t.specs,(e,t)=>P(e.trail,t.trail,(e,t)=>e.kind===`Dot`?t.kind===`Dot`&&e.field===t.field:t.kind===`Apply`&&I(e.expression,t.expression))&&I(e.value,t.value));case`Dot`:return t.kind===`Dot`&&I(e.expression,t.expression)&&e.field===t.field;case`Sub`:case`Tsub`:return t.kind===e.kind&&e.modal===t.modal&&I(e.action,t.action)&&I(e.subscript,t.subscript);case`Fair`:return t.kind===`Fair`&&e.fairness===t.fairness&&I(e.subscript,t.subscript)&&I(e.action,t.action);case`Case`:return t.kind!==`Case`||!(e.arms.length===0||t.arms.length===0?e.arms.length===t.arms.length:I(e.arms[0].condition,t.arms[0].condition)&&I(e.arms[0].body,t.arms[0].body))?!1:e.other&&t.other?I(e.other,t.other):!e.other&&!t.other;case`String`:return t.kind===`String`&&e.value===t.value;case`Num`:return t.kind===`Num`&&e.integer===t.integer&&e.fraction===t.fraction;case`At`:return t.kind===`At`&&e.isExcept===t.isExcept}},ue=(e,t)=>e.map(e=>e.domain.kind===`Domain`?{...e,domain:{kind:`Domain`,expression:t(e.domain.expression)}}:e),de=(e,t)=>e.kind===`Instance`||e.kind===`Label`?{...e,args:e.args.map(t)}:e,fe=(e,t)=>e.map(e=>{let n=t(e.value);return{trail:e.trail.map(e=>e.kind===`Apply`?{kind:`Apply`,expression:t(e.expression)}:e),value:n}}),pe=(e,t)=>e.kind===`Operator`||e.kind===`Bpragma`?{...e,body:t(e.body)}:e,me=(e,t,n)=>e.kind===`Fresh`?e.domain?{...e,domain:t(e.domain)}:e:e.kind===`Flex`||n===`visible`&&e.visibility===`Hidden`?e:e.kind===`Defn`?{...e,definition:pe(e.definition,t)}:{...e,expression:t(e.expression)},L=(e,t,n,r,i=`visible`)=>{let a=t=>n(e,t),o=t=>t.reduce((e,t)=>r(e,D(t.name,t.level)),e);switch(t.kind){case`Ix`:case`Internal`:case`Opaque`:case`String`:case`Num`:case`At`:return t;case`Lambda`:{let i=t.params.reduce((e,t)=>{let n=D(t.name,`Unknown`,t.shape);return r(e,t.location?{...n,location:t.location}:n)},e);return{...t,body:n(i,t.body)}}case`Sequent`:{let[a,o]=E(e,t.sequent.context,(e,t)=>{let a=me(t,t=>n(e,t),i);return[r(e,a),a]});return{...t,sequent:{context:o,active:n(a,t.sequent.active)}}}case`Let`:{let[i,a]=E(e,t.definitions,(e,t)=>{let i=pe(t,t=>n(e,t));return[r(e,{kind:`Defn`,definition:i,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),i]});return{...t,definitions:a,body:n(i,t.body)}}case`Quant`:case`Fcn`:{let e=ue(t.bounds,a);return{...t,bounds:e,body:n(o(e),t.body)}}case`SetOf`:{let e=ue(t.bounds,a);return{...t,bounds:e,element:n(o(e),t.element)}}case`Tquant`:{let i=t.names.reduce((e,t)=>r(e,{kind:`Flex`,name:t}),e);return{...t,body:n(i,t.body)}}case`Choose`:{let i=t.domain&&a(t.domain),o=i?ee(t.name,i):D(t.name,`Constant`);return{...t,domain:i,body:n(r(e,o),t.body)}}case`SetSt`:{let i=a(t.domain),o=ee(t.name,i);return{...t,domain:i,body:n(r(e,o),t.body)}}case`Bang`:{let e=t.selectors.map(e=>de(e,a));return{...t,expression:a(t.expression),selectors:e}}case`Apply`:{let e=t.args.map(a);return{...t,operator:a(t.operator),args:e}}case`With`:case`Dot`:case`Parens`:return{...t,expression:a(t.expression)};case`If`:{let e=a(t.alternative),n=a(t.consequent);return{...t,condition:a(t.condition),consequent:n,alternative:e}}case`List`:return{...t,items:t.items.map(a)};case`SetEnum`:case`Tuple`:return{...t,elements:t.elements.map(a)};case`Product`:return{...t,factors:t.factors.map(a)};case`FcnApp`:{let e=t.args.map(a);return{...t,function:a(t.function),args:e}}case`Arrow`:{let e=a(t.range);return{...t,domain:a(t.domain),range:e}}case`Rect`:case`Record`:return{...t,fields:t.fields.map(e=>({name:e.name,value:a(e.value)}))};case`Except`:{let e=fe(t.specs,a);return{...t,function:a(t.function),specs:e}}case`Sub`:case`Tsub`:case`Fair`:return{...t,subscript:a(t.subscript),action:a(t.action)};case`Case`:{let e=t.other&&a(t.other),n=t.arms.map(e=>{let t=a(e.body);return{condition:a(e.condition),body:t}});return{...t,arms:n,other:e}}}},he=(e,t)=>L(void 0,e,(e,n)=>t(n),()=>void 0,`all`),ge=e=>{let t=[];return he(e,e=>(t.push(e),e)),t},_e={kind:`Opaque`,name:`$Bad`},ve=e=>e.kind===`Opaque`&&e.name===_e.name,ye=e=>{let t=e.kind===`Parens`?ye(e.expression):he(e,ye);if(!t.isAtomic)return t;let{isAtomic:n,...r}=t;return r},be=e=>e.kind===`Let`?_({kind:`Let`,definitions:e.definitions,body:be(e.body)},e.body):e.kind===`Parens`?be(e.expression):he(e,be),xe=e=>e.kind===`Ix`?e.index<=0:ge(e).some(xe),Se=(e,t,n)=>{let r=(e,r=n)=>Se(e,t,r),i=(e,t)=>e.reduce((e,t)=>e??(t.domain.kind===`Domain`?r(t.domain.expression):void 0),void 0)??r(t,[...n,...e.map(e=>D(e.name,e.level))]);switch(e.kind){case`Parens`:return e.form.kind===`Xlabel`?e.form.label===t?{context:n,expression:e.expression,indices:e.form.indices}:void 0:r(e.expression);case`Lambda`:return r(e.body,[...n,...e.params.map(e=>D(e.name,`Unknown`,e.shape))]);case`Let`:{let t=[...n];for(let n of e.definitions){let e=n.kind===`Operator`||n.kind===`Bpragma`?r(n.body,[...t]):void 0;if(e)return e;t.push({kind:`Defn`,definition:n,whereDefined:`Builtin`,visibility:`Visible`,isLocal:!0})}return r(e.body,t)}case`Quant`:case`Fcn`:return i(e.bounds,e.body);case`SetOf`:return i(e.bounds,e.element);case`Tquant`:return r(e.body,[...n,...e.names.map(e=>({kind:`Flex`,name:e}))]);case`Choose`:case`SetSt`:return(e.domain&&r(e.domain))??r(e.body,[...n,D(e.name,`Constant`)]);case`Sequent`:{let t=[...n];for(let n of e.sequent.context){if(n.kind!==`Fact`)return;let e=r(n.expression,[...t]);if(e)return e;t.push(n)}return r(e.sequent.active,t)}default:for(let t of ge(e)){let e=r(t);if(e)return e}return}},Ce=(e,t)=>h(Array.from({length:e},(e,t)=>({kind:`Ix`,index:t+1})),p(e+t)),we=e=>Array.from({length:e},(t,n)=>({kind:`Ix`,index:e-n})),Te=(t,n,r)=>{switch(n.kind){case`Quant`:case`Fcn`:case`SetOf`:{if(n.bounds.length!==r.length){let i=n.bounds.length,a=`Arity mismatch in subexpression instance.\nExpected ${i} argument${i===1?``:`s`}, but found${r.length<i?` only`:``} ${r.length}.`;throw t(d(n.location,a)),new e.M(a,{failure:`Expr.Deref.deref_inst`})}let i=n.kind===`SetOf`?n.element:n.body;return M(h(r,p(0)),i)}case`Tquant`:return Te(t,_({kind:`Quant`,quantifier:n.quantifier,bounds:n.names.map(e=>({name:e,level:`State`,domain:{kind:`NoDomain`}})),body:n.body},n),r);case`Lambda`:return Te(t,_({kind:`Quant`,quantifier:`Forall`,bounds:n.params.map(e=>({name:e.name,level:`Unknown`,domain:{kind:`NoDomain`}})),body:n.body},n),r);case`SetSt`:case`Choose`:if(r.length!==1){let i=`Arity mismatch in subexpression instance.\nExpected 1 argument, but found ${r.length}.`;throw t(d(n.location,i)),new e.M(i,{failure:`Expr.Deref.deref_inst`})}return M(h(r,p(0)),n.body);default:{let r=`Cannot instantiate non-binding expression`;throw t(d(n.location,r)),new e.M(r,{failure:`Expr.Deref.deref_inst`})}}},Ee=(t,n,r)=>{let i=(()=>{switch(r.kind){case`Quant`:case`Fcn`:case`SetOf`:return r.bounds.map(e=>({name:e.name,shape:0}));case`Tquant`:return r.names.map(e=>({name:e,shape:0}));case`Lambda`:return r.params;case`SetSt`:case`Choose`:return[{name:r.name,shape:0}];default:{let n=`Cannot abstract over bound variables in a non-binding expression`;throw t(d(r.location,n)),new e.M(n,{failure:`Expr.Deref.deref_at`})}}})(),a=M(Ce(n,i.length),r);return[i,Te(t,a,we(i.length))]},De=(t,n,r,i,a,o)=>{let s=n=>{if(!(i<=n))throw t(d(a.location,o)),new e.M(o,{failure:`Expr.Deref.deref_num`})},c=e=>(s(e.length),e[i-1]),l=(()=>{switch(r.kind){case`Sequent`:{let a=r.sequent;s(a.context.length+1);let o=a.context[i-1];if(o&&o.kind!==`Fact`){let n=`subexpression reference does not resolve to an expression`;throw t(d(r.location,n)),new e.M(n,{failure:`Expr.Deref.deref_num`})}let c=M(p(-(i-1)),o?o.expression:a.active);if(xe(c))throw t(d(r.location,`subexpression of ASSUME/PROVE uses identifiers declared therein
+Tlapm does not handle yet such subexpression namings.`)),new e.M(`Subexpression of ASSUME/PROVE uses identifiers declared therein
+
+Tlapm does not handle yet such subexpression namings.`,{failure:`Expr.Deref.deref_num`});return[n,c]}case`Apply`:return[n,c(r.args)];case`With`:return De(t,n,r.expression,i,a,o);case`If`:return[n,c([r.condition,r.consequent,r.alternative])];case`List`:return[n,c(r.items)];case`SetEnum`:case`Tuple`:return[n,c(r.elements)];case`Product`:return[n,c(r.factors)];case`Let`:return s(1),[[...n,...r.definitions],r.body];case`Quant`:case`SetOf`:case`Fcn`:return[n,c(r.bounds.flatMap(e=>e.domain.kind===`Domain`?[e.domain.expression]:[]))];case`Choose`:case`SetSt`:if(!r.domain)break;return[n,c([r.domain])];case`Arrow`:return[n,c([r.domain,r.range])];case`FcnApp`:{let e=r.args.length===1?r.args[0]:_({kind:`Tuple`,elements:r.args},r);return[n,c([r.function,e])]}case`Rect`:case`Record`:return[n,c(r.fields.map(e=>e.value))];case`Dot`:return[n,c([r.expression,_({kind:`String`,value:r.field},r)])];case`Except`:return[n,c([r.function,...r.specs.map(e=>e.value)])];case`Sub`:case`Tsub`:return[n,c([r.action,r.subscript])];case`Fair`:return[n,c([r.subscript,r.action])];case`Case`:return[n,c([...r.arms.map(e=>_({kind:`Tuple`,elements:[e.condition,e.body]},e.body)),...r.other?[_({kind:`Tuple`,elements:[_e,r.other]},r.other)]:[]])]}let l=`Expression has no subexpressions`;throw t(d(r.location,l)),new e.M(l,{failure:`Expr.Deref.deref_num`})})();if(ve(l[1])){let n=`Cannot resolve subexpression reference !${i}`;throw t(d(r.location,n)),new e.M(n,{failure:`Expr.Deref.deref_num`})}return l},Oe=(e,t)=>{let n=e.length,r=e;for(let e=n-1;e>=0;e--)r.includes(n-e)||(r=r.map(t=>t+e<n?t:t-1));return r.map(e=>t[n-e])},ke=(t,n,r,i,a)=>{let o=Se(r,i,[]);if(!o)return t(d(r.location,`Could not find label ${i}`)),{params:[],definitions:[],expression:_e};let s=o.indices;if(s.length!==a.length&&a.length>0){let n=s.length===1?``:`s`,r=`Expected ${s.length} argument${n} for labelled reference !${i}, but found ${a.length}`;throw t(d(o.expression.location,r)),new e.M(r,{failure:`Expr.Deref.deref_lsub`})}let c=a.length===0?s.map(e=>({name:e.name,shape:0})):[],l=a.length===0?we(s.length):a,u=o.context.reduceRight((e,t)=>t.kind===`Defn`?_({kind:`Let`,definitions:[t.definition],body:e},e):t.kind===`Fresh`?_({kind:`Quant`,quantifier:`Forall`,bounds:[{name:t.name,level:`Constant`,domain:{kind:`NoDomain`}}],body:e},e):M(p(-1),e),o.expression),f=M(Ce(n,c.length),u),h=[],g=f,v=Oe(s.map(e=>e.index),l);for(;v.length>0;)if(g.kind===`Let`&&g.definitions.length===1)h.push(g.definitions[0]),g=g.body,v=v.map(e=>M(p(1),e));else{if(g.kind!==`Quant`||g.bounds.length!==1)throw new e.F(`File "src/expr/e_deref.ml", line 477, characters 21-33: Assertion failed`);g=M(m(v[0],p(0)),g.body),v=v.slice(1)}return{params:c,definitions:h,expression:g}},Ae=(t,n,r,i,a)=>{if(r.kind!==`Let`)throw t(d(r.location,`not a LET expression`)),new e.M(`not a LET expression`,{failure:`Expr.Deref.deref_letop`});let o=r.definitions.findIndex(e=>e.kind===`Operator`&&e.name===i),s=r.definitions[o];if(!s||s.kind!==`Operator`){let n=`no definition of operator ${i}`;throw t(d(r.location,n)),new e.M(n,{failure:`Expr.Deref.deref_letop`})}let c=s.body,l=c.kind===`Lambda`?_({...c,body:_({kind:`Parens`,expression:c.body,form:{kind:`Xlabel`,label:i,indices:c.params.map((e,t)=>({name:e.name,index:c.params.length-t}))}},c.body)},c):_({kind:`Parens`,expression:c,form:{kind:`Xlabel`,label:i,indices:[]}},c);return ke(t,n,_({kind:`Let`,definitions:r.definitions.slice(0,o),body:l},c),i,a)},je=(t,n,r,i)=>{let[a,...o]=i;if(!a){let e=r.definitions.length===0?r.expression:_({kind:`Let`,definitions:r.definitions,body:r.expression},r.expression),t=r.params.length===0?e:_({kind:`Lambda`,params:r.params,body:e},e);return{...ye(t),isAtomic:!0}}if(r.expression.isAtomic)return t(d(r.expression.location,`Expression has no subexpressions`)),_e;let s=n?r.expression:be(r.expression),c=r.definitions.length,l=(()=>{let i=(e,n)=>{let[i,a]=De(t,[],s,e,r.expression,n);return{params:[],definitions:i,expression:a,rest:o,isLabel:!1}};switch(a.kind){case`Down`:{let[r,...i]=o;if(s.kind===`Let`&&r?.kind===`Label`&&n)return{...Ae(t,c,s,r.label,r.args),rest:i,isLabel:!0};if(n)return{params:[],definitions:[],expression:s,rest:o,isLabel:!1};throw new e.M(`!: is forbidden for this expression.
+`,{failure:`Expr.Deref.deref: !:`})}case`Number`:return i(a.value,`Cannot resolve !${a.value}`);case`Left`:return i(1,`Cannot resolve !<<`);case`Right`:return i(2,`Cannot resolve !>>`);case`Instance`:return{params:[],definitions:[],expression:Te(t,s,a.args),rest:o,isLabel:!1};case`Label`:return{...s.kind===`Let`&&!n?Ae(t,c,s,a.label,a.args):ke(t,c,s,a.label,a.args),rest:o,isLabel:!0};case`At`:{let[e,n]=Ee(t,c,s);return{params:e,definitions:[],expression:n,rest:o,isLabel:!1}}}})();return je(t,l.isLabel,{params:[...r.params,...l.params],definitions:[...r.definitions,...l.definitions],expression:l.expression},l.rest.map(e=>de(e,e=>M(p(l.definitions.length),e))))},Me=(e,t,n)=>{if(n.length>0)return{params:[],definitions:[],expression:Te(e,t,n)};if(t.kind!==`Lambda`)return{params:[],definitions:[],expression:t};let[r,i]=Ee(e,0,t);return{params:r,definitions:[],expression:i}},Ne=(t,n,r,i)=>{let a=je(t,!0,Me(t,n,r),i);if(ve(a)){let r=`Could not resolve subexpression reference`;throw t(d(n.location,r)),new e.M(r,{failure:`Expr.Anon: 2`})}return a},Pe=e=>e.kind===`Named`?`<${e.level}>${e.label}`:`<${e.level}>`,Fe=e=>++e.value,Ie={kind:`Fact`,expression:{kind:`At`,isExcept:!1},visibility:`Visible`},Le={Number:`1NUM`,Down:`1DOWN`,At:`1AT`,Instance:`1INST`,Left:`1`,Right:`1`},Re={kind:`Opaque`,name:`$badexp`},ze=(t,n,r)=>{let i,a=e=>e.scope?.size??0,o=(e,t)=>{if(t.kind===`At`&&t.isExcept)return i?N(a(e)-i.size,i.expression):t;if(t.kind!==`Except`)return h(e,t);let n=o(e,t.function);return t.specs.reduce((n,r)=>{let[s,c]=E(n,r.trail,(t,n)=>{if(n.kind===`Dot`)return[_({kind:`Dot`,expression:t,field:n.field},t),n];let r=o(e,n.expression);return[_({kind:`FcnApp`,function:t,args:[r]},t),{kind:`Apply`,expression:r}]}),l=i;i={expression:s,size:a(e)};let u=o(e,r.value);return i=l,_({kind:`Except`,function:n,specs:[{trail:c,value:u}]},t)},n)},s=(e,t,n)=>{let r=_({kind:`Ix`,index:e},n);return t.length===0?r:_({kind:`Apply`,operator:r,args:t},n)},c=(e,t,n,r,i)=>{if(t!==`Builtin`)return s(e,r,i);let a=N(e,n);return _(r.length===0?a:ne(a,r),i)},l=(t,n,i,a)=>{let o=w(t.scope,n);if(!o){let t=`Operator "${n}" not found`;throw r(d(a.location,t)),new e.M(t,{failure:`Expr.Anon: 4`})}let l=o.depth+1,u=o.hyp;switch(u.kind){case`Defn`:{let t=u.definition;if(t.kind===`Operator`)return c(l,u.whereDefined,t.body,i,a);if(t.kind===`Recursive`)throw new e.M(`Recursive operators not supported by TLAPS`,{failure:`Expr.Anon: Recursive`});return s(l,i,a)}case`Fresh`:return s(l,i,a);case`Flex`:return _({kind:`Ix`,index:l},a);case`Fact`:throw new e.F(`File "src/expr/e_anon.ml", line 230, characters 24-36: Assertion failed`)}},u=(t,n,i,a,s,l)=>{let f=w(t.scope,n);if(!f){let[s,...c]=a;if(s?.kind===`Label`){let e=s.args.map(e=>o(t,e));return u(t,`${n}!${s.label}`,[...i,...e],c,!0,l)}let f=`Operator "${n}" not found`;throw s&&r(d(l.location,f)),new e.M(f,{failure:`Expr.Anon: ${s?Le[s.kind]:`1EMPTY`}`})}let p=f.hyp;if(p.kind!==`Defn`||p.definition.kind!==`Operator`&&p.definition.kind!==`Bpragma`)throw new e.M(`invalid subexpression reference`);let m=f.depth+1;if(a.length===0&&s)return i.length===0?_({kind:`Ix`,index:m},l):c(m,p.whereDefined,p.definition.body,i,l);let h=Be(N(m,p.definition.body),l);return Be(Ne(r,h,i,a),l)},h=(e,t)=>{switch(t.kind){case`Bang`:{let n=t.expression;if(n.kind===`Apply`&&n.operator.kind===`Opaque`){let r=t.selectors.map(t=>de(t,t=>o(e,t))),i=n.args.map(t=>o(e,t)),a={warnedSteps:[],scope:e.scope};return u(a,n.operator.name,i,r,!1,t)}return o(e,{...t,expression:_({kind:`Apply`,operator:n,args:[]},n)})}case`Apply`:{if(t.operator.kind!==`Opaque`)return te(e,t);let n=t.operator.name;if(e.warnedSteps.includes(n))return r({text:`${f(t.location)}Warning: ${n} does not introduce any assumptions. It does not make sense to use it here.\n`,channel:`toolbox`}),_({kind:`Internal`,builtin:`TRUE`},t);let i=t.args.map(t=>o(e,t));return l(e,n,i,t)}case`Opaque`:return o(e,_({kind:`Apply`,operator:t,args:[]},t));case`Parens`:return t.form.kind===`Syntax`?o(e,t.expression):{...t,expression:o(e,t.expression),form:g(e,t.form)};default:return te(e,t)}},g=(t,n)=>n.kind===`Nlabel`?{kind:`Xlabel`,label:n.label,indices:n.names.map(n=>{let r=w(t.scope,n);if(!r)throw new e.M(`Identifier "${n}" in label parameters not found`);return{name:n,index:r.depth+1}})}:n,v=(e,t)=>({warnedSteps:e.warnedSteps,scope:t}),C=(e,t)=>v(e,x(e.scope,t)),ee=(e,t)=>{let n=ue(t,t=>o(e,t));return[n.reduce((e,t)=>C(e,D(t.name,t.level)),e),n]},te=(e,t)=>{if(t.kind===`Sequent`)return{...t,sequent:A(e,t.sequent)[1]};if(t.kind===`Let`){let[n,r]=k(e,t.definitions);return{...t,definitions:r,body:o(n,t.body)}}return L(e,t,o,C)},O=(e,t)=>{if(t.kind!==`Operator`)return t;let n=t.body;if(n.kind!==`Fcn`)return{...t,body:o(e,n)};let r=o(C(e,D(t.name,`Constant`)),n);if(I(M(m({kind:`Opaque`,name:`%%%`},p(1)),r),r))return{...t,body:N(-1,r)};let i=y(`Eq`,[_({kind:`Ix`,index:1},r),r],r);return{...t,body:_({kind:`Choose`,name:t.name,domain:void 0,body:i},r)}},k=(e,t)=>{let r=e,i=[...t],a=[];for(let e=0;e<i.length;e++){let t=i[e];if(t.kind===`Instance`){i.splice(e+1,0,...n(r.scope,t));continue}let o=O(r,t);r=C(r,{kind:`Defn`,definition:o,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),a.push(o)}return[r,a]},re=(e,t)=>{let n=(()=>{switch(t.kind){case`Fresh`:return t.domain?{...t,domain:o(e,t.domain)}:t;case`Flex`:return t;case`Defn`:return{...t,definition:O(e,t.definition)};case`Fact`:return{...t,expression:o(e,t.expression)}}})();return[C(e,n),n]},A=(e,t)=>{let[n,r]=E(e,t.context,re);return[n,{context:r,active:o(n,t.active)}]},ie=(e,t)=>({warnedSteps:[Pe(t),...e.warnedSteps],scope:e.scope}),j=(e,t,n,r)=>C(e,{kind:`Defn`,definition:{kind:`Operator`,name:Pe(t),body:n,location:r.location},whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:r.location}),P=(e,t)=>v(e,S(e.scope,Array.from({length:t},()=>Ie))),ae=e=>{let t=[...e.context.map((t,n)=>{let r=e.context.length-n+1;if(t.kind===`Fact`)return N(r,t.expression);if(t.kind!==`Fresh`||!t.domain)return Re;let i=y(`Mem`,[_({kind:`Ix`,index:0},t.domain),t.domain],t.domain);return N(r,i)}),N(1,e.active)];return t.length===1?t[0]:{kind:`Tuple`,elements:t}},oe=e=>e.kind!==`Use`&&e.kind!==`Hide`&&e.kind!==`Define`,se=(e,t)=>({facts:t.facts.map(t=>o(e,t)),defs:t.defs.flatMap(t=>{if(t.kind===`Dx`)return[t];let n=o(e,_({kind:`Opaque`,name:t.name},t));return n.kind===`Ix`?T(e.scope,n.index-1)?.hyp.kind===`Defn`?[{kind:`Dx`,index:n.index,location:t.location}]:(r({text:`${f(t.location)}${JSON.stringify(t.name)} is not a definition and cannot be used in a DEF clause.`,channel:`toolbox`}),[]):(r({text:`${f(t.location)}Ignored unexpandable identifier ${JSON.stringify(t.name)} in BY DEF.`,channel:`stderr`}),[])})}),F=(e,t)=>{switch(t.kind){case`Steps`:{let[n,r]=E(e,t.steps,ce),i=F(t.step?ie(n,t.step):n,t.qed.proof);return{...t,steps:r,qed:{...t.qed,proof:i}}}case`By`:return{...t,usable:se(e,t.usable)};default:return t}},ce=(n,r)=>{let i=r.step?.kind===`Unnamed`&&oe(r)?{kind:`Named`,level:r.step.level,label:`_a${Fe(t)}`,isAnonymous:!0}:r.step;if(!i)throw new e.F;let a={...r,step:i};switch(a.kind){case`Assert`:{let[,e]=A(n,a.sequent),t=e.context.reduce(C,n),r=P(j(P(t,1),i,_(ae(e),a),a),1),o=e.context.length===0?ie(r,i):r,s={...a,sequent:e,proof:F(o,a.proof)};return[P(j(n,i,_(b(e),a),a),1),s]}case`Pcase`:{let e=o(n,a.expression),t=_({kind:`Tuple`,elements:[N(2,e)]},a),r=P(j(P(n,2),i,t,a),1),s={...a,expression:e,proof:F(r,a.proof)},c=j(n,i,_({kind:`Tuple`,elements:[e]},a),a);return[P(c,1),s]}case`Suffices`:{let[,e]=A(n,a.sequent),t=_({kind:`Tuple`,elements:[_(b(e),a)]},a),r=P(j(n,i,t,a),1),o={...a,sequent:e,proof:F(r,a.proof)},s=e.context.reduce(C,n),c=_({kind:`Tuple`,elements:[_(ae(e),a)]},a);return[P(j(P(s,1),i,c,a),1),o]}case`Have`:{let e=o(n,a.expression),t=_({kind:`Tuple`,elements:[N(2,e)]},a);return[P(j(P(n,2),i,t,a),1),{...a,expression:e}]}case`Take`:{let[e,t]=ee(n,a.bounds),r=_({kind:`Quant`,quantifier:`Forall`,bounds:t,body:Re},a);return[P(j(P(e,1),i,r,a),1),{...a,bounds:t}]}case`Witness`:{let e=a.expressions.map(e=>o(n,e)),t=_({kind:`Tuple`,elements:e},a);return[P(j(P(n,1),i,t,a),1),{...a,expressions:e}]}case`Pick`:{let[e,t]=ee(n,a.bounds),r=o(e,a.expression),s=_({kind:`Quant`,quantifier:`Exists`,bounds:t,body:r},a),c=ie(P(j(P(n,1),i,s,a),1),i),l={...a,bounds:t,expression:r,proof:F(c,a.proof)},u=t.reduce((e,t)=>C(e,D(t.name,t.level)),P(n,2)),d=N(4+t.length,s);return[P(j(P(u,2),i,d,a),1),l]}case`Use`:{let e=se(n,a.usable);return[P(n,e.facts.length),{...a,usable:e}]}case`Hide`:return[n,{...a,usable:se(n,a.usable)}];case`Define`:{let[e,t]=k(n,a.definitions);return[e,{...a,definitions:t}]}case`Forget`:return[n,a]}};return{expr:(e,t)=>o({warnedSteps:[],scope:e},t),defn:(e,t)=>O({warnedSteps:[],scope:e},t),sequent:(e,t)=>A({warnedSteps:[],scope:e},t)[1],usable:(e,t)=>se({warnedSteps:[],scope:e},t),proof:(e,t)=>F({warnedSteps:[],scope:e},t)}},Be=(e,t)=>t.location?{...e,location:t.location}:e,Ve=1000000010,He=new TextEncoder,Ue=e=>{for(let t=0;t<e.length;t++)if(e.charCodeAt(t)>127)return He.encode(e).length;return e.length},We=()=>({leftTotal:-1,element:{size:-1,token:{kind:`Text`,text:``},length:0}}),Ge=()=>{let e={size:-1,token:{kind:`Begin`,indent:0,box:`hov`},length:0};return{queue:[e],queueStart:0,scanStack:[We(),{leftTotal:1,element:e}],formatStack:[],margin:78,maxIndent:68,spaceLeft:78,currentIndent:0,isNewLine:!0,leftTotal:1,rightTotal:1,depth:1,output:[]}},Ke=(e,t)=>{e.rightTotal+=t.length,e.queue.push(t)},qe=(e,t,n)=>{e.output.push(`
+`),e.isNewLine=!0,e.currentIndent=Math.min(e.maxIndent,e.margin-n+t),e.spaceLeft=e.margin-e.currentIndent,e.output.push(` `.repeat(e.currentIndent))},Je=(e,t)=>{e.spaceLeft-=t,e.output.push(` `.repeat(t))},Ye=e=>{let t=e.formatStack.at(-1);t?t.width>e.spaceLeft&&t.box!==`fits`&&t.box!==`h`&&qe(e,0,t.width):e.output.push(`
+`)},Xe=(e,t,n)=>{switch(n.kind){case`Text`:e.spaceLeft-=t,e.output.push(n.text),e.isNewLine=!1;return;case`Begin`:{e.margin-e.spaceLeft>e.maxIndent&&Ye(e);let r=e.spaceLeft-n.indent,i=n.box===`v`||t>e.spaceLeft?n.box:`fits`;e.formatStack.push({box:i,width:r});return}case`End`:e.formatStack.pop();return;case`Newline`:{let t=e.formatStack.at(-1);t?qe(e,0,t.width):e.output.push(`
+`);return}case`Break`:{let r=e.formatStack.at(-1);if(!r)return;let i=r.width;switch(r.box){case`hov`:t>e.spaceLeft?qe(e,n.offset,i):Je(e,n.width);return;case`b`:e.isNewLine?Je(e,n.width):t>e.spaceLeft||e.currentIndent>e.margin-i+n.offset?qe(e,n.offset,i):Je(e,n.width);return;case`hv`:case`v`:qe(e,n.offset,i);return;case`fits`:case`h`:Je(e,n.width);return}}}},Ze=e=>{for(;e.queueStart<e.queue.length;){let t=e.queue[e.queueStart],n=t.size>=0;if(!n&&e.rightTotal-e.leftTotal<e.spaceLeft)return;e.queueStart++,Xe(e,n?t.size:Ve,t.token),e.leftTotal+=t.length}e.queue.length=0,e.queueStart=0},Qe=(e,t)=>{Ke(e,t),Ze(e)},$e=(e,t)=>{let n=e.scanStack.at(-1);n&&(n.leftTotal<e.leftTotal?e.scanStack=[We()]:n.element.token.kind===(t?`Break`:`Begin`)&&(n.element.size=e.rightTotal+n.element.size,e.scanStack.pop()))},et=(e,t,n)=>{Ke(e,n),t&&$e(e,!0),e.scanStack.push({leftTotal:e.rightTotal,element:n})},tt=(e,t,n)=>{e.depth++,et(e,!1,{size:-e.rightTotal,token:{kind:`Begin`,indent:n,box:t},length:0})},nt=e=>{e.depth<=1||(Ke(e,{size:0,token:{kind:`End`},length:0}),$e(e,!0),$e(e,!1),e.depth--)},rt=(e,t,n)=>Qe(e,{size:t,token:{kind:`Text`,text:n},length:t}),it=(e,t,n)=>et(e,!0,{size:-e.rightTotal,token:{kind:`Break`,width:t,offset:n},length:t}),at=e=>Qe(e,{size:0,token:{kind:`Newline`},length:0}),ot=e=>{for(;e.depth>1;)nt(e);return e.rightTotal=Ve,Ze(e),e.output.join(``)},st=e=>{ot(e);let t=[...e.output,`
+`];Object.assign(e,Ge()),e.output=t},ct={h:`h`,v:`v`,hv:`hv`,hov:`hov`,b:`b`},lt=e=>({kind:`Text`,text:e,size:Ue(e)}),R=e=>e===``?[]:[lt(e)],ut={kind:`Break`,width:1,offset:0},dt={kind:`Break`,width:0,offset:0},ft=e=>{let t=e.search(/\d|$/);return{kind:`Open`,box:ct[e.slice(0,t)],indent:Number(e.slice(t)||0)}},z=(e,...t)=>{let n=[],r=0,i=``,a=()=>{i!==``&&(n.push(lt(i)),i=``)};for(let o=0;o<e.length;o++){let s=e[o];if(s===`%`){a();let e=t[r++];typeof e==`string`?e!==``&&n.push(lt(e)):n.push(e),o++}else if(s!==`@`)i+=s;else switch(a(),e[o+1]){case`[`:{if(e[o+2]!==`<`){n.push({kind:`Open`,box:`b`,indent:0}),o++;break}let t=e.indexOf(`>`,o);n.push(ft(e.slice(o+3,t))),o=t;break}case`]`:n.push({kind:`Close`}),o++;break;case` `:n.push(ut),o++;break;case`,`:n.push(dt),o++;break;case`
+`:n.push({kind:`Newline`}),o++;break;case`.`:n.push({kind:`Flush`}),o++;break;case`;`:{let t=e.indexOf(`>`,o),r=e.slice(o+3,t).split(` `);n.push({kind:`Break`,width:Number(r[0]),offset:Number(r[1])}),o=t;break}case`<`:{let i=e.indexOf(`>`,o);n.push({kind:`Text`,text:String(t[r++]),size:Number(e.slice(o+2,i))}),o=i+2;break}}}return a(),n},B=(e,t,n=[lt(`,`),ut])=>e.flatMap((e,r)=>r===0?[t(e)]:[n,t(e)]),pt=(e,t)=>{for(let n of t)if(Array.isArray(n))pt(e,n);else switch(n.kind){case`Open`:tt(e,n.box,n.indent);break;case`Close`:nt(e);break;case`Text`:rt(e,n.size,n.text);break;case`Break`:it(e,n.width,n.offset);break;case`Newline`:at(e);break;case`Flush`:st(e)}},mt=e=>{let t=Ge();return pt(t,e),ot(t)},ht=[[`=>`,1,1,`InfixNon`,[]],[`<=>`,2,2,`InfixNon`,[`\\equiv`]],[`/\\`,3,3,`InfixLeft`,[`\\land`]],[`\\/`,3,3,`InfixLeft`,[`\\lor`]],[`~`,4,4,`Prefix`,[`\\neg`,`\\lnot`]],[`=`,5,5,`InfixNon`,[]],[`#`,5,5,`InfixNon`,[`/=`]],[`SUBSET`,8,8,`Prefix`,[]],[`UNION`,8,8,`Prefix`,[]],[`DOMAIN`,9,9,`Prefix`,[]],[`\\subseteq`,5,5,`InfixNon`,[]],[`\\in`,5,5,`InfixNon`,[]],[`\\notin`,5,5,`InfixNon`,[]],[`\\`,8,8,`InfixNon`,[]],[`\\cap`,8,8,`InfixLeft`,[`\\intersect`]],[`\\cup`,8,8,`InfixLeft`,[`\\union`]],[`\\X`,10,13,`Prefix`,[`\\times`]],[`'`,15,15,`Postfix`,[]],[`~>`,2,2,`InfixNon`,[`\\leadsto`]],[`ENABLED`,4,15,`Prefix`,[]],[`UNCHANGED`,4,15,`Prefix`,[]],[`\\cdot`,5,14,`InfixLeft`,[]],[`-+->`,2,2,`InfixNon`,[]],[`[]`,4,15,`Prefix`,[]],[`<>`,4,15,`Prefix`,[]],[`^`,14,14,`InfixNon`,[]],[`/`,13,13,`InfixNon`,[]],[`*`,13,13,`InfixLeft`,[]],[`-.`,12,12,`Prefix`,[`-`]],[`-`,11,11,`InfixLeft`,[]],[`+`,10,10,`InfixLeft`,[]],[`^+`,15,15,`Postfix`,[]],[`^*`,15,15,`Postfix`,[]],[`^#`,15,15,`Postfix`,[]],[`<`,5,5,`InfixNon`,[]],[`=<`,5,5,`InfixNon`,[`<=`,`\\leq`]],[`>`,5,5,`InfixNon`,[]],[`>=`,5,5,`InfixNon`,[`\\geq`]],[`...`,9,9,`InfixNon`,[]],[`..`,9,9,`InfixNon`,[]],[`|`,10,11,`InfixLeft`,[]],[`||`,10,11,`InfixLeft`,[]],[`&&`,13,13,`InfixLeft`,[]],[`&`,13,13,`InfixLeft`,[]],[`$$`,9,13,`InfixLeft`,[]],[`$`,9,13,`InfixLeft`,[]],[`??`,9,13,`InfixLeft`,[]],[`%%`,10,11,`InfixLeft`,[]],[`%`,10,11,`InfixLeft`,[`\\mod`]],[`##`,9,13,`InfixLeft`,[]],[`++`,10,10,`InfixLeft`,[]],[`--`,11,11,`InfixLeft`,[]],[`**`,13,13,`InfixLeft`,[]],[`//`,13,13,`InfixNon`,[]],[`^^`,14,14,`InfixNon`,[]],[`@@`,6,6,`InfixLeft`,[]],[`!!`,9,13,`InfixNon`,[]],[`|-`,5,5,`InfixNon`,[]],[`|=`,5,5,`InfixNon`,[]],[`-|`,5,5,`InfixNon`,[]],[`=|`,5,5,`InfixNon`,[]],[`<:`,7,7,`InfixNon`,[]],[`:>`,7,7,`InfixNon`,[]],[`:=`,5,5,`InfixNon`,[]],[`::=`,5,5,`InfixNon`,[]],[`(+)`,10,10,`InfixLeft`,[`\\oplus`]],[`(-)`,11,11,`InfixLeft`,[`\\ominus`]],[`(.)`,13,13,`InfixLeft`,[`\\odot`]],[`(/)`,13,13,`InfixNon`,[`\\oslash`]],[`(\\X)`,13,13,`InfixLeft`,[`\\otimes`]],[`\\uplus`,9,13,`InfixLeft`,[]],[`\\sqcap`,9,13,`InfixLeft`,[]],[`\\sqcup`,9,13,`InfixLeft`,[]],[`\\div`,13,13,`InfixNon`,[]],[`\\wr`,9,14,`InfixNon`,[]],[`\\star`,13,13,`InfixLeft`,[]],[`\\o`,13,13,`InfixLeft`,[`\\circ`]],[`\\bigcirc`,13,13,`InfixLeft`,[]],[`\\bullet`,13,13,`InfixLeft`,[]],[`\\prec`,5,5,`InfixNon`,[]],[`\\succ`,5,5,`InfixNon`,[]],[`\\preceq`,5,5,`InfixNon`,[]],[`\\succeq`,5,5,`InfixNon`,[]],[`\\sim`,5,5,`InfixNon`,[]],[`\\simeq`,5,5,`InfixNon`,[]],[`\\ll`,5,5,`InfixNon`,[]],[`\\gg`,5,5,`InfixNon`,[]],[`\\asymp`,5,5,`InfixNon`,[]],[`\\subset`,5,5,`InfixNon`,[]],[`\\supset`,5,5,`InfixNon`,[]],[`\\supseteq`,5,5,`InfixNon`,[]],[`\\approx`,5,5,`InfixNon`,[]],[`\\cong`,5,5,`InfixNon`,[]],[`\\sqsubset`,5,5,`InfixNon`,[]],[`\\sqsubseteq`,5,5,`InfixNon`,[]],[`\\sqsupset`,5,5,`InfixNon`,[]],[`\\sqsupseteq`,5,5,`InfixNon`,[]],[`\\doteq`,5,5,`InfixNon`,[]],[`\\propto`,5,5,`InfixNon`,[]]],gt=/* @__PURE__ */ new Map;for(let[e,t,n,r,i]of ht){let a={name:e,low:t,high:n,fixity:r};for(let t of[e,...i])gt.set(t,a)}const _t=e=>({name:e,low:-1,high:-1,fixity:`Nonfix`}),V=e=>gt.get(e)??_t(e),vt={Implies:`=>`,Equiv:`<=>`,Conj:`/\\`,Disj:`\\/`,Neg:`~`,Eq:`=`,Neq:`#`,SUBSET:`SUBSET`,UNION:`UNION`,DOMAIN:`DOMAIN`,Subseteq:`\\subseteq`,Mem:`\\in`,Notmem:`\\notin`,Setminus:`\\`,Cap:`\\cap`,Cup:`\\cup`,Prime:`'`,StrongPrime:`'`,Leadsto:`~>`,ENABLED:`ENABLED`,UNCHANGED:`UNCHANGED`,Cdot:`\\cdot`,Actplus:`-+->`,BoxTrue:`[]`,BoxFalse:`[]`,Diamond:`<>`,Plus:`+`,Minus:`-`,Times:`*`,Ratio:`/`,Quotient:`\\div`,Remainder:`%`,Exp:`^`,Lteq:`=<`,Lt:`<`,Gteq:`>=`,Gt:`>`,Range:`..`,Cat:`\\o`,OneArg:`:>`,Extend:`@@`},yt=e=>{if(e===`Divides`)return{name:`?|`,low:10,high:11,fixity:`InfixNon`};if(e===`Uminus`)return{...V(`-.`),name:`-`};let t=vt[e];return t?V(t):_t(e)},bt=e=>e.salt===0?e.rep:`${e.rep}_${e.salt}`,xt=()=>({stack:[],idents:/* @__PURE__ */ new Map,defined:/* @__PURE__ */ new Map}),H=(e,t)=>{let n=e.idents.get(t)?.at(-1),r=n?{rep:t,salt:n.salt+1}:{rep:t,salt:0};for(;e.defined.has(bt(r));)r={rep:t,salt:r.salt+1};e.stack.push(r);let i=e.idents.get(t);i?i.push(r):e.idents.set(t,[r]);let a=bt(r);return e.defined.set(a,(e.defined.get(a)??0)+1),a},St=(e,t)=>{for(let n=0;n<t;n++){let t=e.stack.pop();if(!t)return;e.idents.get(t.rep)?.pop();let n=bt(t),r=(e.defined.get(n)??1)-1;r===0?e.defined.delete(n):e.defined.set(n,r)}},U=(e,t,n)=>{let r=n(t.map(t=>H(e,t)));return St(e,t.length),r},Ct=(e,t)=>t.kind===`Atm`||t.kind===`Op`&&e<t.low,wt=e=>[z(`(`),e,z(`)`)],Tt=(e,t)=>t?W(e):wt(W(e)),W=e=>{if(e.kind!==`Op`)return e.doc;let t=e.skeleton,n=t=>Ct(e.high,t);switch(t.kind){case`Prefix`:case`Postfix`:{let r=t.operand,i=Tt(r,n(r)||r.kind===`Op`&&r.skeleton.kind===t.kind),a=t.kind===`Prefix`?[e.doc,i]:[i,e.doc];return[z(`@[<h>`),...a,z(`@]`)]}case`Infix`:{let r=t.left,i=t.right,a=n(r)||r.kind===`Op`&&r.name===e.name&&t.assoc===`Left`,o=n(i)||t.assoc===`Right`&&i.kind===`Op`&&i.skeleton.kind===`Infix`&&i.skeleton.assoc===`Right`;return[z(`@[<b0>`),Tt(r,a),e.doc,Tt(i,o),z(`@]`)]}}},G=e=>({kind:`Atm`,doc:e}),K=e=>({kind:`Big`,doc:e}),Et=e=>e.kind===`Lambda`?Et(e.body):e.kind===`Sequent`?Et(e.sequent.active):e.kind===`With`,Dt=e=>{if(e.kind===`Defn`){let t=e.definition,n=t.kind===`Operator`&&Et(t.body);return e.visibility===`Hidden`||n||e.whereDefined!==`User`}return e.kind===`Fact`?e.visibility===`Hidden`||Et(e.expression):!1},Ot=e=>e===0?[]:z(`@[<hov1>(%a)@]`,B(Array.from({length:e},()=>`_`),R)),kt=e=>z(`%s%a`,e.name,Ot(e.shape)),At={Constant:`CONSTANT`,State:`STATE`,Action:`ACTION`,Temporal:`TEMPORAL`,Unknown:`UNKNOWN`},jt=(t=[])=>{let n=xt(),r=e=>W(u(e)),i=(e,t)=>U(n,e.map(e=>e.name),()=>z(`@[<b2>LAMBDA @[<hv0>%a@] :@ %a@]`,B(e,kt),r(t))),a=(e,t)=>{let i=e.map(e=>e.domain.kind===`Domain`?r(e.domain.expression):void 0);return U(n,e.map(e=>e.name),n=>{let r=[];return e.forEach((e,t)=>{t>0&&e.domain.kind===`Ditto`?r.at(-1)?.names.push(n[t]):r.push({names:[n[t]],index:t})}),t(B(r,t=>{let n=B(t.names,R),r=e[t.index].domain;return r.kind===`NoDomain`?n:r.kind===`Ditto`?z(`@[<hov0>%a@ \\in ??????@]`,n):z(`@[<hov0>%a@ \\in %a@]`,n,i[t.index]??[])}))})},o=e=>{switch(e.kind){case`Down`:return z(`:`);case`Left`:return z(`<<`);case`Right`:return z(`>>`);case`At`:return R(`@`);case`Number`:return R(String(e.value));case`Instance`:return z(`@[<b1>(%a)@]`,B(e.args,r));case`Label`:return e.args.length===0?R(e.label):z(`@[<b2>%s@,@[<b1>(%a)@]@]`,e.label,B(e.args,r))}},s=e=>e.length===0?[]:[z(`!`),B(e,o,z(`!`))],c=e=>{if(e<0)return`#$$${Math.abs(e)}`;if(e===0)return`#$0`;if(e<=n.stack.length)return bt(n.stack[n.stack.length-e]);let r=t[t.length-(e-n.stack.length)];return r?v(r)??`??? FACT ???`:`#$${e}`},l=(t,n)=>{if(t.kind===`Lambda`)return{kind:`Op`,name:` `,doc:z(`@ `),low:20,high:20,skeleton:{kind:`Infix`,assoc:`Left`,left:K(i(t.params,t.body)),right:G(z(`(%a)`,B(n,r)))}};if(t.kind===`Bang`)return n.length===0?u(t):G(z(`@[<b2>%a@[<b1>(%a)@]@]`,r(t),B(n,r)));if(t.kind===`Internal`&&n.length===1){if(t.builtin===`BoxFalse`||t.builtin===`Unprimable`)return u(n[0]);if(t.builtin===`Irregular`)return G(z(`@[<h>@<1>%s%a@<1>%s@]`,`<[`,r(n[0]),`]>`))}let a=(()=>{switch(t.kind){case`Ix`:return V(c(t.index));case`Opaque`:{let e=V(t.name);return{...e,name:`?${e.name}`}}case`Internal`:return yt(t.builtin);default:throw new e.M(`Cannot print this operator`)}})(),o=(e,t)=>({kind:`Op`,name:a.name,doc:e,low:a.low,high:a.high,skeleton:t});if(n.length===0)return G(R(a.name));if(a.fixity===`Nonfix`)return G(z(`@[<b2>%s@[<b1>(%a)@]@]`,a.name,B(n,r)));if(a.fixity===`Prefix`&&n.length===1)return o(/[A-Za-z]$/.test(a.name)?z(`%s@ `,a.name):R(a.name),{kind:`Prefix`,operand:u(n[0])});if(a.fixity===`Postfix`&&n.length===1)return o(R(a.name),{kind:`Postfix`,operand:u(n[0])});if(a.fixity.startsWith(`Infix`)&&n.length===2){let e=a.fixity===`InfixLeft`?`Left`:a.fixity===`InfixRight`?`Right`:`Non`;return o(a.name===`..`?R(a.name):z(`@ %s `,a.name),{kind:`Infix`,assoc:e,left:u(n[0]),right:u(n[1])})}throw new e.M(`Arity mismatch for operator ${a.name}`)},u=t=>{switch(t.kind){case`Ix`:case`Opaque`:case`Internal`:return l(t,[]);case`Lambda`:return K(i(t.params,t.body));case`Bang`:return G([r(t.expression),s(t.selectors)]);case`Apply`:return l(t.operator,t.args);case`Sequent`:return K(p(t.sequent));case`With`:return u(t.expression);case`If`:return K(z(`@[<hv2>@[<b2>IF@ %a@]@ @[<b2>THEN %a@]@ @[<b2>ELSE %a@]@]`,r(t.condition),r(t.consequent),r(t.alternative)));case`List`:{if(t.bullet===`Refs`&&t.items.length===0)return G(z(`TRUE`));if(t.bullet===`Refs`&&t.items.length===1)return u(t.items[0]);let e=t.bullet===`Or`?`\\/`:`/\\`;return K(z(`@[<v0>%a@]`,B(t.items,t=>z(`@[<h>%s %a@]`,e,r(t)),z(`@,`))))}case`Let`:{let e=B(t.definitions,d,z(`@,`)),i=r(t.body);return St(n,t.definitions.length),K([z(`@[<hv0>LET @[<v0>`),e,z(`@]@
+IN  %a@]`,i)])}case`Quant`:return a(t.bounds,e=>K(z(`@[<b3>%s @[<b0>%a@] :@ %a@]`,t.quantifier===`Forall`?`\\A`:`\\E`,e,r(t.body))));case`Tquant`:return U(n,t.names,e=>K(z(`@[<b4>%s @[<b0>%a@] : %a@]`,t.quantifier===`Forall`?`\\AA`:`\\EE`,B(e,R),r(t.body))));case`Choose`:{let e=t.domain&&r(t.domain);return U(n,[t.name],([n])=>K(e?z(`@[<b2>CHOOSE @[<b2>%s \\in@ %a@] :@ %a@]`,n,e,r(t.body)):z(`@[<b2>CHOOSE %s :@ %a@]`,n,r(t.body))))}case`SetSt`:{let e=r(t.domain);return U(n,[t.name],([n])=>G(z(`@[<b3>{@[<b2>%s \\in@ %a@] :@ %a}@]`,n,e,r(t.body))))}case`SetOf`:return a(t.bounds,e=>G(z(`@[<b3>{%a :@ %a}@]`,r(t.element),e)));case`SetEnum`:return G(z(`@[<h>{@[<b0>%a@]}@]`,B(t.elements,r)));case`Arrow`:return G(z(`@[<b3>[%a ->@ %a]@]`,r(t.domain),r(t.range)));case`Fcn`:return a(t.bounds,e=>G(z(`@[<b3>[%a |->@ %a]@]`,e,r(t.body))));case`FcnApp`:{let e=u(t.function),n=e.kind===`Atm`;return G(z(`@[<h>%s%a%s@[<b1>[%a]@]@]`,n?``:`(`,W(e),n?``:`)`,B(t.args,r)))}case`Product`:if(t.factors.length===1)return u(t.factors[0]);if(t.factors.length===0)throw new e.M(`Expr.Fmt.fmt_expr: PRODUCT []`);return{kind:`Op`,name:`\\X`,doc:z(`@ \\X `),low:10,high:13,skeleton:{kind:`Infix`,assoc:`Right`,left:u(t.factors[0]),right:u({...t,factors:t.factors.slice(1)})}};case`Tuple`:return G(z(`@[<b2><<%a>>@]`,B(t.elements,r)));case`Rect`:return G(z(`@[<b1>[%a]@]`,B(t.fields,e=>z(`@[<h>%s : %a@]`,e.name,r(e.value)))));case`Record`:return G(z(`@[<b1>[%a]@]`,B(t.fields,e=>z(`@[<h>%s |-> %a@]`,e.name,r(e.value)))));case`Except`:return G(z(`@[<b3>[%a EXCEPT@ @[<v0>%a@]]@]`,r(t.function),B(t.specs,e=>z(`!@[<h>%a = %a@]`,e.trail.map(e=>e.kind===`Dot`?z(`.%s`,e.field):z(`[%a]`,r(e.expression))),r(e.value)))));case`Dot`:return{kind:`Op`,name:`.`,doc:z(`.`),low:16,high:16,skeleton:{kind:`Infix`,assoc:`Left`,left:u(t.expression),right:G(R(t.field))}};case`Sub`:case`Tsub`:{let e=t.modal===`Box`,n=t.kind===`Sub`?e?`[`:`<<`:e?`[][`:`<><<`;return G(z(`@[<h>%s@[<b2>%a@]%s%a@]`,n,r(t.action),e?`]_`:`>>_`,r(t.subscript)))}case`Fair`:return K(z(`@[<h>%s_%a (%a)@]`,t.fairness===`Weak`?`WF`:`SF`,wt(r(t.subscript)),r(t.action)));case`Case`:return K(z(`@[<v2>CASE %a%a@]`,B(t.arms,e=>z(`@[<b2>%a ->@ %a@]`,r(e.condition),r(e.body)),z(`@,[] `)),t.other?z(`@,[] @[<b2>OTHER ->@ %a@]`,r(t.other)):[]));case`String`:return G(z(`"%s"`,t.value));case`Num`:return G(R(t.fraction===``?t.integer:`${t.integer}.${t.fraction}`));case`At`:return G(R(`@`));case`Parens`:{let e=t.form;if(e.kind===`Syntax`)return u(t.expression);let r=e.kind===`Nlabel`?e.names:e.indices.map(e=>e.index>=1&&e.index<=n.stack.length?c(e.index):`¶${e.index}`),i=u(t.expression);if(r.length===0){let t=i.kind===`Op`?`%s::(%a)`:`%s::%a`;return G(z(t,e.label,W(i)))}let a=B(r,R);return i.kind===`Atm`?G(z(`%s(%a)::%a`,e.label,a,W(i))):i.kind===`Big`?G(z(`%s(%a)::(%a)`,e.label,a,W(i))):G(z(`(%s(%a):: %a)`,e.label,a,W(i)))}}},d=e=>{switch(e.kind){case`Operator`:case`Bpragma`:{let t=e.body;if(t.kind===`Lambda`){let i=U(n,t.params.map(e=>e.name),()=>r(t.body)),a=H(n,e.name);return z(`@[<b2>%s@[<b1>(%a)@] ==@ %a@]`,a,B(t.params,kt),i)}let i=r(t);return z(`@[<b2>%s ==@ %a@]`,H(n,e.name),i)}case`Instance`:{let t=e.instance,i=U(n,t.args,e=>({doc:z(`@[<b2>INSTANCE %s%a@]`,t.module,t.substitutions.length===0?[]:z(`@ WITH@ %a`,B(t.substitutions,e=>z(`@[<b2>%s <- %a@]`,e.name,r(e.expression))))),args:e})),a=H(n,e.name),o=t.args.length===0?R(a):z(`%s (@[<b0>%a@])`,a,B(i.args,R));return z(`@[<b2>%a == %a@]`,o,i.doc)}case`Recursive`:{let t=H(n,e.name);return z(`@[<b2>NEW CONSTANT %s%a@]`,t,Ot(e.shape))}}},f=e=>{switch(e.kind){case`Fresh`:{let t=e.domain&&e.domainVisibility===`Visible`?r(e.domain):void 0,i=H(n,e.name);return[z(`NEW %s %s%a`,At[e.level],i,Ot(e.shape)),t?z(` \\in %a`,t):[]]}case`Flex`:return z(`NEW VARIABLE %s`,H(n,e.name));case`Defn`:return d(e.definition);case`Fact`:{let t=z(`@[<h>%a @]`,r(e.expression));return H(n,``),t}}},p=e=>{if(e.context.length===0)return r(e.active);let t=[];for(let r of e.context)Dt(r)?H(n,v(r)??``):t.push(f(r));let i=r(e.active);return St(n,e.context.length),t.length===0?i:[z(`@[<v0>ASSUME @[<v0>`),B(t,e=>e),z(`@]@
+PROVE  %a@]`,i)]};return{printSequent:p,printExpr:r}},Mt=(e,t)=>jt(e).printExpr(t),Nt=e=>{let t=jt();return mt(z(`@[<b0>%a@]`,t.printSequent(e))).trimEnd()},Pt={kind:`At`,isExcept:!1},q=e=>({location:e.location,step:e.step,isSuppressed:e.isSuppressed}),Ft=e=>e?.kind===`Named`&&e.isAnonymous,It=e=>e?.level??0,Lt=e=>_({kind:`Internal`,builtin:`TRUE`},e),Rt=(e,t)=>e.kind===`Apply`&&e.operator.kind===`Internal`&&e.operator.builtin===t&&e.args.length===2,zt=(e,...t)=>mt(z(e,...t)),Bt=e=>Vt(e).map((e,t)=>{let n=e.domain.kind===`Domain`?N(t,e.domain.expression):void 0;return{kind:`Fresh`,name:e.name,shape:0,level:n?`Constant`:e.level,domain:n,domainVisibility:`Visible`}}),Vt=e=>{let t={kind:`NoDomain`};return e.map(e=>e.domain.kind===`Ditto`?{...e,domain:t}:(t=e.domain,e))},Ht=(e,t)=>t.context.flatMap((n,r)=>n.kind===`Fact`&&n.visibility===`Visible`?[N(e+t.context.length-1-r,n.expression)]:[]),Ut=(t,n)=>{if(!t.step)throw new e.F;return{kind:`Defn`,definition:{kind:`Operator`,name:Pe(t.step),body:n,location:t.location},whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:t.location}},Wt=(e,t,n)=>{let r=Ft(n.step)?`Visible`:`Hidden`,i=t.context.map(e=>e.kind===`Fact`?{...e,visibility:r}:e),a=_({kind:`List`,bullet:`Refs`,items:Ht(2,t)},n);return{context:[...e,...i,{kind:`Fact`,expression:Lt(n),visibility:`Hidden`,location:n.location},Ut(n,a),{kind:`Fact`,expression:_({kind:`Ix`,index:1},n),visibility:`Hidden`,location:n.location}],active:N(3,t.active)}},Gt=(e,t,n,r,i)=>{let a=e||Ft(i.step)?`Visible`:`Hidden`;return{context:[...t,Ut(i,_(b(r),i)),{kind:`Fact`,expression:_({kind:`Ix`,index:1},i),visibility:a,location:i.location}],active:N(2,n)}},Kt=(t,n,r)=>{if(r.kind!==`Dx`)throw new e.M(`Unknown definition ${r.name}`);let i=n.length-r.index,a=n[i];if(!a)return n;if(a.kind!==`Defn`)throw new e.M(`Indicated point is not a definition`);return n.map((e,n)=>n===i?{...a,visibility:t}:e)},qt=(e,t)=>e.kind===`Apply`&&e.operator.kind===`Internal`&&e.operator.builtin===`Mem`&&e.args[0]?.kind===`Ix`&&e.args[0].index===0&&I(t,e.args[1]),Jt=(t,n,r,i)=>{let a=!1,o=r,s=[...i];for(let e=i.length-1;e>=0;e--){o=N(-1,o);let t=i[e];t.kind===`Fact`&&I(t.expression,o)?(a=!0,s[e]={...t,visibility:n}):t.kind===`Fresh`&&t.domain&&qt(o,t.domain)&&(a=!0,s[e]={...t,domainVisibility:n})}if(!a){let n=`This expression does not appear in the context and cannot be hidden.`;throw t(d(r.location,`${n}\n`)),new e.M(n,{failure:`proof.Gen.set_expr`})}return s},Yt=(e,t)=>{let n=re(p(1),t)[1];return n[0].domain.kind===`Ditto`&&e.domain.kind===`Domain`?[{...n[0],domain:{kind:`Domain`,expression:N(1,e.domain.expression)}},...n.slice(1)]:n},Xt=(e,t)=>{if(e.isSuppressed||t.length===0)return{kind:`Obvious`,...q(e)};let n=t.map((e,t)=>{let n=N(2*t+2,e);return{kind:`Assert`,sequent:{context:[],active:n},proof:{kind:`By`,usable:{facts:[N(3,n)],defs:[]},isOnly:!1,location:e.location},location:e.location}}),r={kind:`By`,usable:{facts:[_({kind:`Ix`,index:2*t.length+2},e),...t.map((n,r)=>_({kind:`Ix`,index:2*(t.length-r)},e))],defs:[]},isOnly:!0,...q(e)};return{kind:`Steps`,steps:n,qed:{proof:r,location:r.location},...q(e)}},Zt=(e,t,n)=>({sequent:e,location:t.location,kind:n}),Qt={total:0,absent:[],omitted:[]},$t=(e,t)=>({total:e.total+t.total,absent:[...e.absent,...t.absent],omitted:[...e.omitted,...t.omitted]}),en=e=>{switch(e.kind){case`Use`:return{...Qt,total:e.obligations?.length??0};case`Assert`:case`Suffices`:case`Pcase`:case`Pick`:return tn(e.proof);default:return Qt}},tn=e=>e.kind===`Steps`?[...e.steps.map(en),tn(e.qed.proof)].reduce($t):e.kind!==`Omitted`||!e.obligations||!e.location?{...Qt,total:e.obligations?.length??0}:{total:e.obligations.length,absent:e.omission===`Implicit`?[e.location]:[],omitted:e.omission===`Explicit`?[e.location]:[]},nn=(e,t)=>e.kind===`At`&&!e.isExcept?_(k(t),e):he(e,e=>nn(e,t)),rn=(t,n,r,i)=>{let a=(t,i)=>{let s=i.location;if(!s||!n.has(s.file)||s.endLine<r.start||s.startLine>r.end)return i;switch(i.kind){case`Obvious`:return{...i,obligations:[Zt(t,i,{kind:`Main`})]};case`Omitted`:return{...i,obligations:[Zt(t,i,{kind:`Omitted`,omission:i.omission})]};case`Error`:return{...i,obligations:[Zt(t,i,{kind:`Error`,message:i.message})]};case`By`:throw new e.M(`Proof.Gen.generate`);case`Steps`:{let[e,n]=E(t,i.steps,o),r=a(e,i.qed.proof);return{...i,steps:n,qed:{...i.qed,proof:r}}}}},o=(t,n)=>{switch(n.kind){case`Forget`:{let e=t.context.length,r=t.context.map((t,r)=>t.kind===`Fact`&&t.visibility===`Visible`&&n.count+r<e?{...t,visibility:`Hidden`}:t);return[{...t,context:r},n]}case`Use`:{let r=n.usable;if(r.defs.length===0&&r.facts.length===1){let e=r.facts[0],i=Zt({...t,active:e},n,{kind:`Support`});return[{context:[...t.context,{kind:`Fact`,expression:e,visibility:`Visible`,location:e.location}],active:N(1,t.active)},{...n,obligations:[i]}]}if(r.facts.length>0)throw new e.M(`Proof.Gen.gen_step: USE with facts and definitions`);let i=r.defs.reduce((e,t)=>Kt(`Visible`,e,t),t.context);return[{...t,context:i},n]}case`Hide`:{let e=n.usable.defs.reduce((e,t)=>Kt(`Hidden`,e,t),t.context),r=n.usable.facts.reduceRight((e,t)=>Jt(i,`Hidden`,t,e),e);return[{...t,context:r},n]}case`Define`:return[{context:[...t.context,...n.definitions.map(e=>({kind:`Defn`,definition:e,whereDefined:`User`,visibility:`Visible`,isLocal:!0,location:e.location}))],active:N(n.definitions.length,t.active)},n];case`Assert`:{let e=a(Wt(t.context,n.sequent,n),n.proof),r={...n,proof:e};return[Gt(!1,t.context,t.active,n.sequent,r),r]}case`Suffices`:{let e=a(Gt(!0,t.context,t.active,n.sequent,n),n.proof),r={...n,proof:e};return[Wt(t.context,n.sequent,r),r]}default:throw new e.M(`Proof.Gen.gen_step`)}},s=(e,t,n,r)=>{let i={kind:`Unnamed`,level:0,id:0},[a,s]=o({context:e,active:{...Pt,location:r}},t===`Use`?{kind:`Use`,usable:n,isOnly:!1,location:r,step:i}:{kind:`Hide`,usable:n,location:r,step:i});return[a.context,s.obligations??[]]},c=(e,t,n,r)=>{if(n.defs.length===0&&n.facts.length===0)return[e,[]];let i=n.defs.length>0,[a,...o]=n.facts,[l,u]=s(e,t,i?{defs:n.defs,facts:[]}:{defs:[],facts:[a]},r),d=i?n.facts:o.map(e=>N(1,e)),[f,p]=c(l,t,{defs:[],facts:d},r);return[f,[...u,...p]]},l=e=>{let t=[],n=e=>{e.kind===`Steps`?(n(e.qed.proof),e.steps.forEach(r)):e.obligations&&!e.isSuppressed&&t.push(...e.obligations)},r=e=>{e.kind===`Use`&&e.obligations&&!e.isSuppressed&&t.push(...e.obligations),(e.kind===`Assert`||e.kind===`Suffices`||e.kind===`Pcase`||e.kind===`Pick`)&&n(e.proof)};return n(e),t},u=e=>({kind:`Named`,level:e,label:`_a${Fe(t)}`,isAnonymous:!0}),d=(e,t)=>t?.kind===`Named`?{...t,level:e}:u(e),f=(e,t)=>{let n={...t,step:d(e,t.step)};if(n.kind!==`Steps`)return n;let r=n.steps.map(t=>h(e,t));return{...n,steps:r,qed:{...n.qed,proof:f(e+1,n.qed.proof)}}},h=(e,t)=>{let n={...t,step:d(e,t.step)};switch(n.kind){case`Assert`:case`Suffices`:case`Pcase`:case`Pick`:return{...n,proof:f(e+1,n.proof)};default:return n}},g=(t,n)=>{let r=n.kind===`Apply`?n.operator:n;if(r.kind===`Ix`){let i=t[t.length-r.index];if(!i)throw new e.M(`expose_connective`);if(i.kind!==`Defn`||i.definition.kind!==`Operator`)return n;let a=N(r.index,i.definition.body);if(n.kind!==`Apply`)return g(t,a);let o={...a,location:n.location};return g(t,_(ne(o,n.args),o))}if(n.kind===`Apply`&&n.operator.kind===`Internal`&&n.operator.builtin===`Prime`){let e=g(t,n.args[0]),r=e=>y(`Prime`,[e],e);return e.kind===`Quant`?_({kind:`Quant`,quantifier:e.quantifier,bounds:e.bounds.map(e=>e.domain.kind===`Domain`?{...e,domain:{kind:`Domain`,expression:r(e.domain.expression)}}:e),body:r(e.body)},n):Rt(e,`Implies`)||Rt(e,`Mem`)?_({kind:`Apply`,operator:e.operator,args:[r(e.args[0]),r(e.args[1])]},n):r(e)}return n.kind===`Parens`?g(t,n.expression):n},v=e=>{if(e.kind!==`Assert`)return;let t=e.sequent.active;return t.kind===`Apply`&&t.args.length===2?t.args[1]:void 0},b=e=>{if(e.kind!==`Steps`)return e;let t=[];return e.steps.forEach(e=>{let n=t.at(-1),r=n&&v(n);if(e.kind!==`Assert`||!r){t.push(e);return}let i=nn(e.sequent.active,N(2,r));t.push({...e,sequent:{...e.sequent,active:i}})}),{...e,steps:t}},x=(e,t,n)=>{let r=b(n);switch(r.kind){case`Obvious`:case`Omitted`:case`Error`:return r;case`By`:{let e=r.usable,t=e.defs.length===0?[]:[{kind:`Use`,usable:{facts:[],defs:e.defs},isOnly:!1,location:r.location}],n=e.facts.map((e,t)=>({kind:`Use`,usable:{facts:[N(t,e)],defs:[]},isOnly:!1,location:e.location,isSuppressed:r.isSuppressed})),i=r.isOnly?[{kind:`Forget`,count:e.facts.length,location:r.location}]:[],a=It(r.step),o=[...t,...n,...i].map(e=>({...e,step:u(a)})),s={kind:`Obvious`,location:r.location,step:u(a),isSuppressed:r.isSuppressed};return{kind:`Steps`,steps:o,qed:{proof:s,location:s.location,step:s.step},location:r.location,step:r.step,isSuppressed:r.isSuppressed}}case`Steps`:{let n=e,i=t,a=r.steps.flatMap(e=>{let[t,r,a]=S(n,i,e);return n=t,i=r,a}),o=x(n,i,r.qed.proof);return{...r,steps:a,qed:{...r.qed,proof:o}}}}},S=(t,n,r)=>{let i=It(r.step);switch(r.kind){case`Forget`:return[t,n,[r]];case`Assert`:{let e=Wt(t,r.sequent,r),i={...r,proof:x(e.context,e.active,r.proof)},a=Gt(!1,t,n,r.sequent,i);return[a.context,a.active,[i]]}case`Suffices`:{let e=Gt(!0,t,n,r.sequent,r),i={...r,proof:x(e.context,e.active,r.proof)},a=Wt(t,r.sequent,i);return[a.context,a.active,[i]]}case`Use`:{let i={kind:`By`,usable:r.usable,isOnly:r.isOnly,location:r.location,step:r.step,isSuppressed:r.isSuppressed},a=x(t,n,i);if(a.kind!==`Steps`)throw new e.M(`simplifying BY does not produce a non-leaf proof!`);let o=r.usable.facts.map(()=>({kind:`Fact`,expression:Pt,visibility:`Visible`,location:r.location}));return[[...t,...o],N(r.usable.facts.length,n),a.steps]}case`Hide`:return[r.usable.defs.reduce((t,n)=>{if(n.kind!==`Dx`)throw new e.M(`set_vis`);let i=t.length-n.index,a=t[i];if(a?.kind!==`Defn`){let t=a?a.kind===`Fact`?`??? FACT ???`:a.name:``;throw new e.M(`USE DEF ${t} invalid because ${t} is not a defined operator`)}return t.map((e,t)=>t===i?{...a,visibility:`Hidden`,location:r.location}:e)},t),n,[r]];case`Define`:return[[...t,...r.definitions.map(e=>({kind:`Defn`,definition:e,whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:r.location}))],N(r.definitions.length,n),[r]];case`Have`:{let e=g(t,n),a={kind:`Fact`,expression:r.expression,visibility:`Visible`,location:r.location},o=Rt(e,`Implies`),s={context:[a],active:o?N(1,e.args[1]):e},c=o?{kind:`By`,usable:{facts:[_({kind:`Ix`,index:2},r)],defs:[]},isOnly:!0,...q(r)}:{kind:`Error`,message:zt(`@.@[<v2>@[%s@ %s@]@,%a@]@.`,`Error: this HAVE step is applied to the following goal,`,`which is not an implication:`,Mt(t,n)),...q(r)},l=h(i,{kind:`Suffices`,sequent:s,proof:c,location:r.location,step:r.step});return S(t,n,l)}case`Take`:return S(t,n,h(i,w(t,n,r)));case`Witness`:return S(t,n,h(i,T(t,n,r)));case`Pcase`:{let e={kind:`Assert`,sequent:{context:[{kind:`Fact`,expression:r.expression,visibility:`Visible`,location:r.location}],active:N(1,n)},proof:r.proof,...q(r)};return S(t,n,h(i,e))}case`Pick`:{let i=_({kind:`Quant`,quantifier:`Exists`,bounds:r.bounds,body:r.expression},r),a=C(r.step,`ex`),[o,s,c]=S(t,n,{kind:`Assert`,sequent:{context:[],active:i},proof:r.proof,...q(r),step:a}),l=N(2,i);if(l.kind!==`Quant`)throw new e.M(`Proof.Simplify.simplify_step/PICK`);let u=[...Bt(l.bounds),{kind:`Fact`,expression:l.body,visibility:`Visible`,location:l.body.location}],[d,f,p]=S(o,s,{kind:`Suffices`,sequent:{context:u,active:N(u.length,s)},proof:{kind:`Omitted`,omission:`Elsewhere`,...q(r)},...q(r)});return[d,f,[...c,...p]]}}},C=(e,n)=>({kind:`Named`,level:It(e),label:`${e?.kind===`Named`?e.label:`_a`}${n}${Fe(t)}`,isAnonymous:!1}),w=(e,t,n)=>{let r=Vt(n.bounds),i=(t,n,r,a)=>{let o=a[0];if(!o)return{aux:n,goal:r};let s=g(e,r);if(s.kind!==`Quant`||s.quantifier!==`Forall`||s.bounds.length===0)return zt(`@.@[<v2>@[<b0>%s@ %s@]@,%a@]@.`,`Error: this TAKE step is applied to the following goal,`,`which is not a universal formula:`,Mt(e,r));let c=s.bounds[0],l=Vt(s.bounds).slice(1),u=o.domain,d=c.domain;if(u.kind===`NoDomain`&&d.kind===`Domain`)return zt(`@.@[<b0>%s (%s)@ %s (%s \\in %a)@]@.`,`Error: the TAKE argument`,o.name,`does not match the pattern`,c.name,Mt(e,d.expression));if(u.kind===`Domain`&&d.kind===`NoDomain`)return zt(`@.@[<b0>%s (%s \\in %a)@ %s (%s)@]@.`,`Error: the TAKE argument`,o.name,Mt(e,u.expression),`does not match the pattern`,c.name);let f=u.kind===`Domain`&&d.kind===`Domain`&&!I(u.expression,d.expression)?[{kind:`Apply`,operator:{kind:`Internal`,builtin:`Subseteq`},args:[d.expression,u.expression]},...n]:n;if(l.length===0)return i(1,f,s.body,a.slice(1));let m=a.length===1?l.map(e=>re(p(t),[e])[1][0]):l;return i(t+1,f,_({kind:`Quant`,quantifier:`Forall`,bounds:m,body:s.body},s),a.slice(1))},a=i(1,[],t,r);if(typeof a==`string`)return{kind:`Suffices`,sequent:{context:[{kind:`Fact`,expression:Lt(t),visibility:`Visible`,location:n.location}],active:t},proof:{kind:`Error`,message:a,...q(n)},...q(n)};let o=a.aux.filter((e,t)=>a.aux.findIndex(t=>I(e,t))===t),s=[_({kind:`Ix`,index:2},n),...o.map(e=>N(2,e))];return{kind:`Suffices`,sequent:{context:Bt(r),active:a.goal},proof:{kind:`By`,usable:{facts:s,defs:[]},isOnly:!0,...q(n)},...q(n)}},T=(e,t,n)=>{let r=[],i=``,a=t;for(let t of n.expressions){let n=g(e,a);if(n.kind!==`Quant`||n.quantifier!==`Exists`||n.bounds.length===0){i||=zt(`@.@[<v2>@[<b0>%s@ %s@]@,%a@]@.`,`Error: this WITNESS step is applied to the following goal,`,`which is not an existential formula:`,Mt(e,n)),a=n;break}let[o,...s]=n.bounds,c=s.length===0?n.body:_({kind:`Quant`,quantifier:`Exists`,bounds:Yt(o,s),body:n.body},n),l=t;if(o.domain.kind===`Domain`){let n=o.domain.expression,a=g(e,t);if(Rt(a,`Mem`)){let[e,t]=a.args,i=I(t,n)?[]:[y(`Subseteq`,[t,n],t)];r.push(...i,a),l=e}else i||=zt(`@.@[<b0>%s (%a)@ %s (%s \\in %a)@]@.`,`Error: the WITNESS argument`,Mt(e,a),`does not match the pattern`,o.name,Mt(e,n)),l=a}let u=y(`Unprimable`,[l],l);a=M(m(u,p(0)),c)}let o=i===``?Xt(n,r):{kind:`Error`,message:i,...q(n)};return{kind:`Suffices`,sequent:{context:[],active:a},proof:o,...q(n)}};return{generate:a,collect:l,mutate:c,simplify:x}},J=(e,t=0)=>({level:e,weights:Array.from({length:t},()=>!0),params:/* @__PURE__ */ new Set}),an={TRUE:[0,0],FALSE:[0,0],Implies:[0,2],Equiv:[0,2],Conj:[0,2],Disj:[0,2],Neg:[0,1],Eq:[0,2],Neq:[0,2],STRING:[0,0],BOOLEAN:[0,0],SUBSET:[0,1],UNION:[0,1],DOMAIN:[0,1],Subseteq:[0,2],Mem:[0,2],Notmem:[0,2],Setminus:[0,2],Cap:[0,2],Cup:[0,2],Actplus:[3,2],BoxTrue:[3,1],BoxFalse:[3,1],Diamond:[3,1],Prime:[2,1],StrongPrime:[2,1],ENABLED:[1,1],UNCHANGED:[2,1],Leadsto:[3,2],Cdot:[2,2],Nat:[0,0],Int:[0,0],Real:[0,0],Infinity:[0,0],Plus:[0,2],Minus:[0,2],Times:[0,2],Ratio:[0,2],Quotient:[0,2],Remainder:[0,2],Exp:[0,2],Divides:[0,2],Lteq:[0,2],Lt:[0,2],Gteq:[0,2],Gt:[0,2],Range:[0,2],Uminus:[0,1],Seq:[0,1],Len:[0,1],BSeq:[0,2],Cat:[0,2],Append:[0,2],Head:[0,1],Tail:[0,1],SubSeq:[0,3],SelectSeq:[0,2],OneArg:[0,2],Extend:[0,2],Print:[0,2],PrintT:[0,1],Assert:[0,2],JavaTime:[0,0],TLCGet:[0,1],TLCSet:[0,2],Permutations:[0,1],SortSeq:[0,2],RandomElement:[0,1],Any:[0,0],ToString:[0,1],Unprimable:[0,1]},on={Constant:0,State:1,Action:2,Temporal:3,Unknown:0},sn=e=>new Set(e.flatMap(e=>[...e])),Y=e=>({level:Math.max(0,...e.map(e=>e.level)),weights:[],params:sn(e.map(e=>e.params))}),cn=/* @__PURE__ */ new WeakMap,ln=t=>{let n=t.hyp;switch(n.kind){case`Flex`:return J(1);case`Fresh`:return{...J(on[n.level],n.shape),params:/* @__PURE__ */ new Set([n.name])};case`Defn`:{let r=n.definition;if(r.kind!==`Operator`&&r.kind!==`Bpragma`)throw new e.F;return X(t.rest,r.body)}case`Fact`:return X(t.rest,n.expression)}},un=e=>{let t=cn.get(e);if(t)return t;let n=ln(e);return cn.set(e,n),n},dn=(e,t,n)=>{let r=t.flatMap(t=>t.domain.kind===`Domain`?[X(e,t.domain.expression)]:[]),i=t.reduce((e,t)=>x(e,D(t.name,t.level)),e);return Y([X(i,n),...r])},fn=(t,n)=>{if(t.weights.length!==n.length)throw new e.M(`Invalid number of arguments`);let r=n.filter((e,n)=>t.weights[n]);return{level:Math.max(t.level,...r.map(e=>e.level)),weights:[],params:sn([t.params,...r.map(e=>e.params)])}},X=(t,n)=>{let r=e=>X(t,e);switch(n.kind){case`Ix`:{let r=T(t,n.index-1);if(!r)throw new e.F;return un(r)}case`Internal`:{let t=an[n.builtin];if(!t)throw new e.F;return J(t[0],t[1])}case`Opaque`:case`String`:case`Num`:return J(0);case`Lambda`:{let e=n.params.reduce((e,t)=>x(e,D(t.name,`Unknown`,t.shape)),t),r=X(e,n.body),i=new Set(n.params.map(e=>e.name));return{level:r.level,weights:n.params.map(e=>r.params.has(e.name)),params:new Set([...r.params].filter(e=>!i.has(e)))}}case`Apply`:{let t=n.operator;if(t.kind===`Opaque`)return fn(J(0,n.args.length),n.args.map(r));if(t.kind===`Internal`&&n.args.length===1){let i=n.args[0];switch(t.builtin){case`Prime`:case`StrongPrime`:if(r(i).level>1)throw new e.F;return J(2,1);case`ENABLED`:{let t=r(i);if(t.level>2)throw new e.F;return{level:1,weights:[],params:t.params}}case`UNCHANGED`:{let t=r(i);if(t.level>1)throw new e.F;return{level:2,weights:[],params:t.params}}}}return t.kind===`Internal`&&t.builtin===`Cdot`?(n.args.forEach(r),J(2)):t.kind===`Internal`&&t.builtin===`Leadsto`?(n.args.forEach(r),J(3,2)):fn(r(t),n.args.map(r))}case`Sequent`:{let[e,r]=E(t,n.sequent.context,(e,t)=>{let n=x(e,t);return[n,un(n).level]});return J(Math.max(0,...r,X(e,n.sequent.active).level))}case`With`:case`Dot`:case`Parens`:return r(n.expression);case`Let`:{let e=n.definitions.reduce((e,t)=>x(e,{kind:`Defn`,definition:t,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),t);return X(e,n.body)}case`If`:return Y([n.condition,n.consequent,n.alternative].map(r));case`List`:return Y(n.items.map(r));case`Quant`:case`Fcn`:return dn(t,n.bounds,n.body);case`SetOf`:return dn(t,n.bounds,n.element);case`Tquant`:return X(n.names.reduce((e,t)=>x(e,{kind:`Flex`,name:t}),t),n.body),J(3);case`Choose`:case`SetSt`:{let e=n.domain&&r(n.domain),i=n.domain?ee(n.name,n.domain):D(n.name,`Constant`);return Y([X(x(t,i),n.body),...e?[e]:[]])}case`SetEnum`:case`Tuple`:return Y(n.elements.map(r));case`Product`:return Y(n.factors.map(r));case`FcnApp`:return Y([n.function,...n.args].map(r));case`Arrow`:return Y([r(n.domain),r(n.range)]);case`Rect`:case`Record`:return Y(n.fields.map(e=>r(e.value)));case`Except`:return Y([r(n.function),...n.specs.flatMap(e=>[...e.trail.flatMap(e=>e.kind===`Apply`?[r(e.expression)]:[]),r(e.value)])]);case`Sub`:return{...Y([r(n.action),r(n.subscript)]),level:2};case`Tsub`:case`Fair`:return r(n.action),r(n.subscript),J(3);case`Case`:return Y([...n.arms.flatMap(e=>[r(e.condition),r(e.body)]),...n.other?[r(n.other)]:[]]);case`Bang`:case`At`:throw new e.F}},pn=(t,n)=>{let r=T(t,n-1)?.hyp;if(!r)throw new e.F;return r},mn=e=>e.kind===`Internal`&&(e.builtin===`ENABLED`||e.builtin===`Cdot`),hn=e=>e.kind===`Apply`&&e.args.length===1&&e.args[0].kind===`Lambda`&&(mn(e.operator)||e.operator.kind===`Opaque`&&(e.operator.name===`EnabledWrapper`||e.operator.name===`CdotWrapper`)),gn=e=>e===void 0?2:Math.min(2,e),_n=e=>e===void 0?void 0:Math.max(1,e-1),vn=(t,n,r,i)=>{let a=(e,r=i)=>vn(t,n,e,r);if(hn(r))return r;if(r.kind===`Sub`)return{...r,action:a(r.action),subscript:a(r.subscript,_n(i))};if(r.kind===`Apply`&&r.operator.kind===`Internal`){let e=r.operator.builtin,[t,n]=r.args;if(e===`Cdot`&&r.args.length===2)return{...r,args:[a(t,gn(i)),a(n,1)]};if(e===`ENABLED`&&r.args.length===1)return{...r,args:[a(t,gn(i))]};if((e===`Prime`||e===`UNCHANGED`)&&r.args.length===1)return{...r,args:[a(t,_n(i))]}}let o=r.kind===`Apply`&&r.operator.kind===`Ix`?r.operator:r;if(o.kind!==`Ix`)return L(n,r,(e,n)=>vn(t,e,n,i),x);if(i===void 0)return r;let s=X(n,r).level,c=pn(n,o.index),f=e=>`The operator \`${e}\` is declared at:\n${c.location?l(c.location):`<unknown location>`}`;if(c.kind===`Fresh`&&c.level===`Unknown`)throw t(d(r.location,`Declared operator \`${c.name}\` has unknown level and occurs within the scope of \`ENABLED\` or \`\\cdot\` where soundness requires expanding expressions of level >= ${i}.\nIf a constant operator is substituted for this operator, then the expression that results from applying this declared operator has expression level ${s}.\n May need expansion. A declared operator cannot be expanded.\n${f(c.name)}\n and has arity: ${c.shape}`)),new e.F(`File "src/expr/e_action.ml", line 367, characters 20-26: Assertion failed`);if(s<i)return r;if(s>2||c.kind===`Fact`)throw new e.F;if(c.kind===`Flex`){if(r.kind!==`Ix`)throw new e.F;return r}if(c.kind===`Fresh`){let n=`The expression that results from applying the declared operator \`${c.name}\` has expression level ${s} within the scope of \`ENABLED\` or \`\\cdot\` where soundness requires expanding expressions of level >= ${i}. A declared operator cannot be expanded.\n${f(c.name)}\n and has level: ${on[c.level]}\n and arity: ${c.shape}`;throw t(d(r.location,n)),new e.M(n)}let m=c.definition;if(m.kind!==`Operator`&&m.kind!==`Bpragma`)throw new e.F;t({text:`${u(r.location)}[INFO]: Auto-expanding the definition of operator:  ${m.name}\n`,channel:`stdout`});let h=M(p(o.index),m.body);return a(k(r.kind===`Apply`?ne(h,r.args):h))},yn=e=>y(`Eq`,[y(`Prime`,[e],e),e],e),bn=e=>{let t=e=>e.kind===`Tuple`?e.elements.flatMap(t):[e],n=t(e);return n.length===0?_({kind:`Internal`,builtin:`TRUE`},e):n.length===1?yn(n[0]):_({kind:`List`,bullet:`And`,items:n.map(yn)},e)},xn=t=>{if(t.kind===`Apply`&&t.args.length===1)return bn(t.args[0]);if(t.kind!==`Sub`)throw new e.F;let n=bn(t.subscript),r=t.modal===`Box`?n:y(`Neg`,[n],t);return y(t.modal===`Box`?`Disj`:`Conj`,[t.action,r],t)},Sn=e=>{let t=(e,t)=>e<<t|e>>>32-t,n=(e,n)=>{let r=Math.imul(t(Math.imul(n,3432918353),15),461845907);return Math.imul(t(e^r,13),5)+3864292196|0},r=new TextEncoder().encode(e),i=r.length-r.length%4,a=0;for(let e=0;e<i;e+=4)a=n(a,r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24);let o=r.subarray(i).reduceRight((e,t)=>e<<8|t,0);return r.length>i&&(a=n(a,o)),a^=r.length,a=Math.imul(a^a>>>16,2246822507),a=Math.imul(a^a>>>13,3266489909),(a^a>>>16)&1073741823},Cn=e=>{let t=Array.from({length:16},()=>[]);return e.forEach((e,n)=>{if(t[Sn(e)&t.length-1].unshift(e),n+1<=t.length*2)return;let r=Array.from({length:t.length*2},()=>[]);t.flat().forEach(e=>r[Sn(e)&r.length-1].push(e)),t=r}),t.flat()},wn=(t,n,r,i,a)=>{let o=e=>wn(t,n,r,i,e),s=n!==void 0||r!==void 0,c=(e,o)=>{let s={names:[],depth:Math.max(n?.depth??0,r?.depth??0)+1},[c,l]=o,u=[wn(t,n,s,i,c),...l?[wn(t,s,r,i,l)]:[]],d=s.names.length===0?[`r#0`]:Cn(s.names);return _({kind:`Apply`,operator:e,args:[{kind:`Lambda`,params:[`_`,...d].map(e=>({name:e,shape:0})),body:u.length===1?u[0]:{kind:`List`,bullet:`And`,items:u}}]},a)};if(hn(a))return a;if(a.kind===`Apply`&&a.operator.kind===`Internal`){let e=a.operator.builtin;if(e===`ENABLED`&&a.args.length===1||e===`Cdot`&&a.args.length===2)return c(a.operator,a.args);if(e===`Prime`&&a.args.length===1){let e=wn(t,r,void 0,i,a.args[0]);return r?e:{...a,args:[e]}}if(e===`UNCHANGED`&&s)return o(xn(a))}if(a.kind===`Sub`&&s)return o(xn(a));if(a.kind===`Ix`){if(!n)return a;let t=pn(i,a.index);if(t.kind===`Fact`)throw new e.F;if(t.kind!==`Flex`)return a;let r=`${t.name}#enabled#prime${n.depth}`;return n.names.includes(r)||n.names.push(r),_({kind:`Opaque`,name:r},a)}if(a.kind===`Apply`&&a.operator.kind===`Opaque`)throw t(d(a.location,`Named operator \`${a.operator.name}\` unexpected after anonymization.`)),new e.F(`File "src/expr/e_action.ml", line 1048, characters 12-18: Assertion failed`);return L(i,a,(e,i)=>wn(t,n,r,e,i),x)},Tn=(t,n)=>{if(n.kind===`Apply`&&mn(n.operator)){let[r]=n.args;if(n.args.length!==1||r.kind!==`Lambda`)throw new e.F;let[i,...a]=r.params;if(i.name!==`_`)return n;let o=Tn({kind:`Compose`,outer:t,inner:p(a.length)},r.body);return{kind:`Apply`,operator:n.operator,args:[{kind:`Lambda`,params:a,body:o}]}}return n.kind===`Ix`?M(t,n):n.kind===`Apply`?_(ne(Tn(t,n.operator),n.args.map(e=>Tn(t,e))),n):L(t,n,Tn,e=>g(1,e))},En=t=>{if(t.kind===`Apply`&&mn(t.operator)){let[n]=t.args;if(t.args.length!==1||n.kind!==`Lambda`||n.params[0].name===`_`)throw new e.F;let r=t.operator.builtin===`Cdot`?`CdotWrapper`:`EnabledWrapper`;return{kind:`Apply`,operator:_({kind:`Opaque`,name:r},t.operator),args:[{kind:`Lambda`,params:n.params.map((e,t)=>({name:`r#${t}`,shape:0})),body:En(n.body)}]}}return L(void 0,t,(e,t)=>En(t),()=>void 0)},Dn=t=>{if(t.kind===`Apply`&&t.operator.kind===`Internal`&&t.operator.builtin===`Cdot`&&t.args.length===1&&t.args[0].kind!==`Lambda`)throw new e.F;return L(void 0,t,(e,t)=>Dn(t),()=>void 0)},On=(e,t,n,r)=>{let i=vn(t,n,r,void 0),a=Tn(p(0),wn(t,void 0,void 0,n,i));return Dn(En(e.expr(n,a)))},kn=(e,t)=>({kind:`Definition`,definition:{kind:`Operator`,name:e,body:{kind:`Internal`,builtin:t}},whereDefined:`Builtin`,visibility:`Visible`,isLocal:!1}),Z=(e,t,n)=>({kind:`Definition`,definition:{kind:`Operator`,name:t,body:{kind:`Lambda`,params:Array.from({length:e},(e,t)=>({name:`x${t+1}`,shape:0})),body:{kind:`Apply`,operator:{kind:`Internal`,builtin:n},args:Array.from({length:e},(t,n)=>({kind:`Ix`,index:e-n}))}}},whereDefined:`Builtin`,visibility:`Visible`,isLocal:!1}),An=[kn(`Nat`,`Nat`),Z(2,`+`,`Plus`),Z(2,`-`,`Minus`),Z(2,`*`,`Times`),Z(2,`^`,`Exp`),Z(2,`<`,`Lt`),Z(2,`>`,`Gt`),Z(2,`=<`,`Lteq`),Z(2,`>=`,`Gteq`),Z(2,`%`,`Remainder`),Z(2,`\\div`,`Quotient`),Z(2,`..`,`Range`)],jn=[...An,kn(`Int`,`Int`),Z(1,`-.`,`Uminus`)],Mn=[...jn,kn(`Real`,`Real`),Z(2,`/`,`Ratio`),kn(`Infinity`,`Infinity`)],Nn=[Z(1,`Seq`,`Seq`),Z(1,`Len`,`Len`),Z(2,`BSeq`,`BSeq`),Z(2,`\\o`,`Cat`),Z(2,`Append`,`Append`),Z(1,`Head`,`Head`),Z(1,`Tail`,`Tail`),Z(3,`SubSeq`,`SubSeq`),Z(2,`SelectSeq`,`SelectSeq`)],Pn=[Z(2,`Print`,`Print`),Z(1,`PrintT`,`PrintT`),Z(2,`Assert`,`Assert`),kn(`JavaTime`,`JavaTime`),Z(1,`TLCGet`,`TLCGet`),Z(2,`TLCSet`,`TLCSet`),Z(2,`:>`,`OneArg`),Z(2,`@@`,`Extend`),Z(1,`Permutations`,`Permutations`),Z(2,`SortSeq`,`SortSeq`),Z(1,`RandomElement`,`RandomElement`),kn(`Any`,`Any`),Z(1,`ToString`,`ToString`)],Fn=(e,t)=>({name:e,extendees:[],body:t,isImportant:!1,isStandard:!0}),In=new Map([Fn(`Naturals`,An),Fn(`Integers`,jn),Fn(`Reals`,Mn),Fn(`Sequences`,Nn),Fn(`TLC`,Pn)].map(e=>[e.name,e])),Ln=e=>{let t=e.location;switch(e.kind){case`Constants`:return e.declarations.map(e=>({kind:`Fresh`,name:e.name,shape:e.shape,level:`Constant`,domain:void 0,domainVisibility:`Visible`,location:t}));case`Recursives`:return e.declarations.map(e=>({kind:`Defn`,definition:{kind:`Recursive`,name:e.name,shape:e.shape,location:t},whereDefined:`User`,visibility:`Hidden`,isLocal:!1,location:t}));case`Variables`:return e.names.map(e=>({kind:`Flex`,name:e,location:t}));case`Definition`:return[{kind:`Defn`,definition:e.definition,whereDefined:e.whereDefined,visibility:e.visibility,isLocal:e.isLocal,location:t}];case`Axiom`:return e.name===void 0?[{kind:`Fact`,expression:e.expression,visibility:`Hidden`,location:t}]:zn(e.name,e.expression,t);case`Theorem`:{let n=j(p(-e.axiomCount),{...e.sequent,context:e.sequent.context.slice(e.axiomCount)}),r=_(b(n),e);return e.name===void 0?[{kind:`Fact`,expression:r,visibility:`Hidden`,location:t}]:zn(e.name,r,t)}case`Mutate`:return e.mode===`Use`?e.usable.facts.map((e,n)=>({kind:`Fact`,expression:N(n,e),visibility:`Visible`,location:t})):[];case`Submod`:case`Anoninst`:return[]}},Rn=e=>e.kind===`Axiom`||e.kind===`Theorem`?e.name===void 0?1:2:Ln(e).length,zn=(e,t,n)=>[{kind:`Defn`,definition:{kind:`Operator`,name:e,body:t,location:n},whereDefined:`User`,visibility:`Visible`,isLocal:!1,location:n},{kind:`Fact`,expression:{kind:`Ix`,index:1,location:n},visibility:`Hidden`,location:n}],Bn=e=>e.body.flatMap(e=>{switch(e.kind){case`Definition`:return[{...e,whereDefined:e.isLocal?`Builtin`:e.whereDefined}];case`Mutate`:return[];case`Theorem`:return[{...e,proof:{kind:`Omitted`,omission:`Elsewhere`,location:e.location}}];case`Submod`:return[{...e,module:{...e.module,body:Bn(e.module)}}];default:return[e]}}),Vn=(t,n,r,i=/* @__PURE__ */ new Set([n.name]))=>{let a=[];for(let o of n.extendees){if(r.has(o))continue;if(i.has(o))throw new e.F(`Stack overflow`);let n=t.get(o);if(!n)throw new e.M(`Module "${o}" unknown`);a.push(...Bn(Vn(t,n,r,/* @__PURE__ */ new Set([...i,o])))),r.add(o)}return{...n,body:[...a,...n.body].map(e=>e.kind===`Submod`?{...e,module:Vn(t,e.module,/* @__PURE__ */ new Set)}:e)}},Hn=e=>{let t=/* @__PURE__ */ new Map,n=(e,n)=>{t.has(e)||t.set(e,n)},r=e=>e.extendees.forEach((t,r)=>n(t,e.extendeeLocations?.[r])),i=/* @__PURE__ */ new Set,a=/* @__PURE__ */ new Map,o=e=>{typeof e==`object`&&e&&(`instance`in e&&Un(e.instance)&&n(e.instance.module,e.instance.location),Object.values(e).forEach(o))},s=e=>{e.kind===`Theorem`?o(e.sequent):e.kind!==`Submod`&&o(e),e.kind===`Submod`&&(i.add(e.module.name),a.set(e.module.name,e.module),r(e.module),e.module.body.forEach(s))};return e.body.forEach(s),i.forEach(e=>t.delete(e)),r(e),{dependencies:[...t.keys()].sort(Wn),locations:t,submodules:a}},Un=e=>typeof e==`object`&&!!e&&`module`in e&&typeof e.module==`string`&&`substitutions`in e,Wn=(e,t)=>e<t?-1:+(e>t),Gn=(t,n)=>({facts:O(t,n.facts),defs:n.defs.map(n=>{if(n.kind===`Dvar`)return n;let r=M(t,{kind:`Ix`,index:n.index});if(r.kind!==`Ix`)throw new e.M(`substitution produced bad definition`);return{...n,index:r.index}})}),Kn=(e,t)=>{switch(t.kind){case`Constants`:case`Recursives`:return[g(t.declarations.length,e),t];case`Variables`:return[g(t.names.length,e),t];case`Definition`:return[g(1,e),{...t,definition:A(e,t.definition)}];case`Axiom`:return[g(Rn(t),e),{...t,expression:M(e,t.expression)}];case`Theorem`:return[g(Rn(t),e),{...t,sequent:j(e,t.sequent)}];case`Submod`:return[e,{...t,module:{...t.module,body:qn(e,t.module.body)}}];case`Mutate`:return[t.mode===`Hide`?e:g(t.usable.facts.length,e),{...t,usable:Gn(e,t.usable)}];case`Anoninst`:return[e,{...t,instance:{...t.instance,substitutions:t.instance.substitutions.map(t=>({name:t.name,expression:M(e,t.expression)}))}}]}},qn=(e,t)=>E(e,t,Kn)[1],Jn=(t,n,r,i)=>{try{let r=On(t.anonymizer,t.onWarning,n,{kind:`Sequent`,sequent:i});if(r.kind!==`Sequent`)throw new e.F;return r.sequent}catch(n){if(!(n instanceof e.M)||n.failure===void 0)throw n;let a=i.active.location,o=`${n.failure}\nCould not instantiate the theorem ${r===void 0?``:`named: ${r}, `}at: ${a?l(a):`<unknown location>`}`;return t.onWarning({text:`${u(a)}[ERROR]${o}`,channel:`stdout`}),t.onWarning({text:o,channel:`toolboxOnly`}),{context:[],active:_({kind:`Internal`,builtin:`TRUE`},i.active)}}},Yn=(e,t,n)=>{if(n.kind===`Theorem`)return{...n,sequent:Jn(e,t,n.name,n.sequent)};if(n.kind!==`Definition`)return n;let r=n.definition;if(r.kind!==`Operator`&&r.kind!==`Bpragma`)return n;let i=On(e.anonymizer,e.onWarning,t,r.body);return{...n,definition:{...r,body:i}}},Xn=(e,t,n)=>E(t,n,(t,n)=>{if(n.kind===`Submod`){let[r,i]=Xn(e,t,n.module.body);return[r,{...n,module:{...n.module,body:i}}]}let r=Yn(e,t,n);return[S(t,Ln(r)),r]}),Zn=(t,n)=>{let r=[],i=0,a=t;for(;a.length>0;){let[t,...o]=a,s=t.kind===`Constants`?{name:t.declarations[0].name,remaining:{...t,declarations:t.declarations.slice(1)}}:t.kind===`Variables`?{name:t.names[0],remaining:{...t,names:t.names.slice(1)}}:void 0;if(s){let t=n.get(s.name);if(!t)throw new e.M(`Parameter ${s.name} has no substitute`);let r=Rn(s.remaining)===0;a=qn(m(N(i,t),p(0)),r?o:[s.remaining,...o])}else r.push(t),i+=Rn(t),a=o}return r},Qn=(e,t,n)=>{let r=Array.from({length:t},(e,r)=>_({kind:`Ix`,index:t-r},{location:n})),i=Array.from({length:t},(e,t)=>_({kind:`Ix`,index:t+1},{location:n})),a=Array.from({length:e},(e,i)=>{let a=_({kind:`Ix`,index:i+t+1},{location:n});return t>0?_({kind:`Apply`,operator:a,args:r},{location:n}):a});return h([...a,...i].reverse(),p(e+t))},$n=(e,t)=>{let n=t.map(e=>({name:e,shape:0}));return e.kind===`Lambda`?{...e,params:[...n,...e.params]}:t.length===0?e:_({kind:`Lambda`,params:n,body:e},e)},er=(t,n,r,i,a,o)=>{let s=e=>r===``?e:`${r}!${e}`,c=i.args.length,l=[],d=0,m=n,h=c===0,g=e=>{h||(h=!0,t.onWarning({text:e,channel:`stderr`}))};for(;m.length>0;){let[n,...r]=m;m=r;let h=e=>$n(M(Qn(d,c,o),e),i.args);switch(n.kind){case`Definition`:{let r=n.definition;if(r.kind!==`Operator`&&r.kind!==`Bpragma`)throw new e.M(`Module.Elab.localize`);let i=n.isLocal?`${r.name}$${Fe(t.salts)}`:r.name;l.push({...n,definition:{...r,name:s(i),body:h(r.body)},whereDefined:n.isLocal?`Builtin`:n.whereDefined,isLocal:n.isLocal||a}),d+=1;continue}case`Axiom`:{g(`${f(o)}Instancing produces parametric axioms.\nSuch axioms will be forcibly hidden and cannot be cited.\n(This warning appears at-most once per INSTANCE declaration.)`);let e={...n,name:n.name===void 0?void 0:s(n.name),expression:h(n.expression)};l.push(e),d+=Rn(e);continue}case`Theorem`:{g(`${u(o)}Warning: Instancing produces parametric theorems.\nSuch theorems will be forcibly hidden and cannot be cited.\n(This warning appears at-most once per INSTANCE declaration.)`);let e=h(_(b(n.sequent),n));l.push({...n,name:n.name===void 0?void 0:s(n.name),sequent:e.kind===`Sequent`?e.sequent:{context:[],active:e},proof:{kind:`Omitted`,omission:`Elsewhere`,location:n.location}}),d+=1;continue}case`Mutate`:n.mode===`Use`&&(m=qn(p(-n.usable.facts.length),m));continue;case`Submod`:continue;default:throw new e.M(`Module.Elab.localize`)}}return l},tr=e=>{let t=[],n=e;for(;n.length>0;){let[e,...r]=n;if(e.kind!==`Axiom`){t.push(e),n=r;continue}let i=e.location;e.name!==void 0&&t.push({kind:`Definition`,definition:{kind:`Operator`,name:e.name,body:e.expression,location:i},whereDefined:`Proof`,visibility:`Visible`,isLocal:!1,location:i});let a={kind:`Fact`,expression:e.name===void 0?N(1,e.expression):_({kind:`Ix`,index:2},e),visibility:`Visible`,location:i},o=0,s=r.map(e=>{let t=o;if(o+=Rn(e),e.kind!==`Theorem`)return e;let n=j(p(1),e.sequent);return{...e,sequent:{...n,context:[ie(p(t),a),...n.context]},axiomCount:e.axiomCount+1}});n=qn(p(-1),s)}return t},nr=e=>new Set(e.body.flatMap(e=>e.kind===`Constants`?e.declarations.map(e=>e.name):e.kind===`Variables`?e.names:[])),rr=(t,n,r,i,a,o,s)=>{let c=n.get(i.module);if(!c)throw new e.M(`Module "${i.module}" unknown`);let l=nr(c);for(let t of i.substitutions)if(!l.has(t.name))throw new e.M(`Parameter ${t.name} occurs in the statement \`INSTANCE ${i.module} WITH\`, and is not declared in the module ${i.module}`);let u=S(r,i.args.map(e=>D(e,`Unknown`))),d=new Map(i.substitutions.map(e=>[e.name,e.expression]));for(let t of[...l].sort(Wn))if(!d.has(t)){if(!w(u,t))throw new e.M(`Required parameter ${t} for module ${i.module} could not be inferred.`);d.set(t,_({kind:`Opaque`,name:t},{location:s}))}let f=new Map([...d].map(([e,n])=>[e,t.anonymizer.expr(u,n)])),m=qn(p((u?.size??0)-(c.depth??0)),c.body.map(e=>e.kind===`Theorem`?{...e,proof:{kind:`Omitted`,omission:`Implicit`,location:e.proof.location}}:e)),[,h]=Xn(t,u,m);return tr(er(t,Zn(h,f),o,i,a,s))},ir=(e,t,n)=>e===void 0?{hyps:[],sequent:t}:{hyps:[{kind:`Defn`,definition:{kind:`Operator`,name:e,body:_(b(t),{location:n}),location:n},whereDefined:`Proof`,visibility:`Visible`,isLocal:!1,location:n}],sequent:j(p(1),t)},ar=(t,n,r)=>{let i=r.instance.module;if(!t.latestModules.has(i))throw t.onWarning({text:`${f(r.instance.location)}Module ${JSON.stringify(i)} unknown\n`,channel:`toolbox`}),new e.M(`Module ${JSON.stringify(i)} unknown`,{failure:`Module.Elab.anon#defns`});let a=rr(t,t.latestModules,n,r.instance,!0,r.name,r.location),o=[],s=a;for(;s.length>0;){let[e,...t]=s;e.kind===`Definition`?(o.push(e.definition),s=t):s=qn(p(-Rn(e)),t)}return o},or=(e,t,n,r)=>{let i=[],a=n,o=e=>{i.push(e),a=S(a,Ln(e))},s=e=>e!==void 0&&w(a,e)!==void 0,c=r.body.map(e=>({unit:e,isAnonymized:!1}));for(let n=0;n<c.length;n++){let i=c[n].unit,l=(r,o,s)=>{let l=rr(e,t,a,r,o,s,i.location);c.splice(n+1,0,...l.map(e=>({unit:e,isAnonymized:!0})))};switch(i.kind){case`Anoninst`:l(i.instance,i.isLocal,``);continue;case`Definition`:{let t=i.definition;if(t.kind===`Instance`){l(t.instance,i.isLocal,t.name);continue}let r=t.kind===`Recursive`||c[n].isAnonymized?t:e.anonymizer.defn(a,t),s={...i,definition:r};if(t.kind===`Recursive`){o(s);continue}let u=Ln(s)[0],d=w(a,t.name);if(d?.hyp.kind===`Defn`&&(d.hyp.definition.kind===`Recursive`||ce(ie(p(d.depth+1),d.hyp),u))){let e=c.slice(n+1),t=qn(m(_({kind:`Ix`,index:d.depth+1},i),p(0)),e.map(e=>e.unit));c.splice(n+1,e.length,...e.map((e,n)=>({...e,unit:t[n]})));continue}o(s);continue}case`Recursives`:case`Constants`:case`Variables`:o(i);continue;case`Axiom`:if(s(i.name))continue;e.latestModules=new Map(t),o({...i,expression:e.anonymizer.expr(a,i.expression)});continue;case`Theorem`:{let n=s(i.name),c=n?`(redundant)${i.name}`:i.name,l=n?{kind:`Obvious`,location:i.proof.location}:i.proof;e.latestModules=new Map(t);let u=e.anonymizer.sequent(a,i.sequent),d=ir(c,u,i.location),f=S(S(a,d.hyps),d.sequent.context),p=e.anonymizer.proof(f,l),m=r.isImportant?e.generator.simplify(C(f),d.sequent.active,p):p;o({...i,name:c,sequent:u,proof:m});continue}case`Mutate`:e.latestModules=new Map(t),o({...i,usable:e.anonymizer.usable(a,i.usable)});continue;case`Submod`:o({...i,module:or(e,t,a,i.module)});continue}}let l={...r,body:i,depth:n?.size??0};return t.set(r.name,l),l},sr=(e,t,n)=>{let r=[],i=[],a=Qt,o=t;for(let t of n.body)switch(t.kind){case`Theorem`:{let n=ir(t.name,t.sequent,t.location),s=[...o,...n.hyps],c=e.generator.generate({context:[...s,...n.sequent.context],active:n.sequent.active},t.proof);r.push(...e.generator.collect(c));let l=tn(c);i.push({...l,location:t.location}),a=$t(a,l);let u=t.name===void 0?_(b(t.sequent),t):{kind:`Ix`,index:1,location:t.location};o=[...s,{kind:`Fact`,expression:u,visibility:`Hidden`,location:t.location}];continue}case`Submod`:{let n=sr(e,o,t.module);r.push(...n.obligations),a=$t(a,n.summary);continue}case`Mutate`:{let[n,i]=e.generator.mutate(o,t.mode,t.usable,t.location);r.push(...i),o=n;continue}default:o=[...o,...Ln(t)]}return{obligations:r,summary:{...a,theorems:i}}},cr=e=>({kind:`Opaque`,name:e}),lr=e=>({kind:`Tuple`,elements:e.map(cr)}),ur=(e,t)=>({kind:`Apply`,operator:{kind:`Internal`,builtin:`Eq`},args:[e,t]}),dr=e=>e.map(e=>({name:e,level:`Constant`,domain:{kind:`NoDomain`}})),fr=(e,t)=>e?.kind===`Product`&&e.factors.length===t.length?e.factors:void 0,pr=(e,t)=>t.map((t,n)=>({kind:`Operator`,name:t,body:{kind:`FcnApp`,function:cr(e),args:[{kind:`Num`,integer:String(n+1),fraction:``}]}})),mr=(e,t)=>e.map((e,n)=>({name:e,level:`Constant`,domain:{kind:`Domain`,expression:t[n]}})),hr=e=>({name:e.name,level:`Constant`,domain:e.domain}),gr=(e,t,n)=>{let r=[];return t.forEach(e=>{e.kind===`Name`&&e.domain.kind===`Ditto`?r.at(-1)?.push(e):r.push([e])}),r.reduceRight((t,n)=>{let r=n[0];if(r.kind===`Name`)return{kind:`Quant`,quantifier:e,bounds:n.flatMap(e=>e.kind===`Name`?[hr(e)]:[]),body:t,location:t.location};let i=fr(r.domain,r.names);if(i)return{kind:`Quant`,quantifier:e,bounds:mr(r.names,i),body:t,location:t.location};let a={kind:`Apply`,operator:{kind:`Internal`,builtin:e===`Exists`?`Mem`:`Notmem`},args:[lr(r.names),r.domain]};return{kind:`Quant`,quantifier:e,bounds:dr(r.names),body:{kind:`List`,bullet:e===`Exists`?`And`:`Or`,items:[a,t]},location:t.location}},n)},_r=(e,t,n,r)=>fr(n,t)?{kind:`Let`,definitions:pr(e,t),body:r}:{kind:`Quant`,quantifier:`Exists`,bounds:dr(t),body:{kind:`List`,bullet:`And`,items:[ur(cr(e),lr(t)),r]}},vr=(e,t,n)=>{let r=`choose#${e[0]}`;return{kind:`Choose`,name:r,domain:t,body:_r(r,e,t,n)}},yr=(e,t,n)=>{let r=`setst#${e[0]}`;return{kind:`SetSt`,name:r,domain:t,body:_r(r,e,t,n)}},br=(e,t,n)=>{let r=e.map(e=>{if(e.kind===`Name`)return{bounds:[hr(e)],definitions:[]};let t=fr(e.domain,e.names);if(t&&n)return{bounds:mr(e.names,t),definitions:[]};let r=`fcn#${e.names[0]}`,i={name:r,level:`Constant`,domain:{kind:`Domain`,expression:e.domain}};if(t)return{bounds:[i],definitions:pr(r,e.names)};let a=`choose#${r}`;return{bounds:[i],definitions:[{kind:`Operator`,name:a,body:vr(e.names,void 0,ur(cr(r),lr(e.names)))},...pr(a,e.names)]}}),i=r.flatMap(e=>e.definitions);return{bounds:r.flatMap(e=>e.bounds),value:i.length===0?t:{kind:`Let`,definitions:i,body:t}}},xr=(e,t)=>{let n=br(t,e,!0);return{kind:`SetOf`,element:n.value,bounds:n.bounds}},Sr=(e,t)=>{let n=br(e,t,!1);return{kind:`Fcn`,bounds:n.bounds,body:n.value}},Cr={"=>":`Implies`,"<=>":`Equiv`,"/\\":`Conj`,"\\/":`Disj`,"~":`Neg`,"=":`Eq`,"#":`Neq`,SUBSET:`SUBSET`,UNION:`UNION`,DOMAIN:`DOMAIN`,"\\subseteq":`Subseteq`,"\\in":`Mem`,"\\notin":`Notmem`,"\\":`Setminus`,"\\cap":`Cap`,"\\cup":`Cup`,"'":`Prime`,"~>":`Leadsto`,ENABLED:`ENABLED`,UNCHANGED:`UNCHANGED`,"\\cdot":`Cdot`,"-+->":`Actplus`,"[]":`BoxTrue`,"<>":`Diamond`,TRUE:`TRUE`,FALSE:`FALSE`,BOOLEAN:`BOOLEAN`,STRING:`STRING`},Q=(e,t=!1)=>t&&e===`-`?`-.`:V(e).name,wr=/^<(\d+|\*|\+)>([A-Za-z0-9_]*)\.*$/,$=(e,t)=>{if(!e||!t)return e??t;let n=e.startLine<t.startLine||e.startLine===t.startLine&&e.startColumn<=t.startColumn,r=e.endLine>t.endLine||e.endLine===t.endLine&&e.endColumn>=t.endColumn;return{file:e.file,startLine:n?e.startLine:t.startLine,startColumn:n?e.startColumn:t.startColumn,endLine:r?e.endLine:t.endLine,endColumn:r?e.endColumn:t.endColumn}},Tr={Always:`[]`,Eventually:`<>`,Enabled:`ENABLED`,Unchanged:`UNCHANGED`},Er=(e,t)=>e!==void 0&&t!==void 0&&e.line===t.line&&e.column===t.column,Dr=e=>e.location.range?.start,Or=e=>e.location.range?.end,kr=(e,t)=>{let n=e.location.range;return n&&t?{...e,location:{...e.location,range:{...n,end:t}}}:e},Ar=e=>{if(e.kind===`Apply`){let t=V(e.operator),n=e.args.length===2&&t.fixity.startsWith(`Infix`),r=e.args.length===1&&t.fixity===`Prefix`;if(!n&&!r)return;let i=e.args.length-1;return{operator:t,isInfix:n,operand:e.args[i],replace:t=>({...e,args:[...e.args.slice(0,i),t]})}}let t=Tr[e.kind];if(t!==void 0&&`expression`in e)return{operator:V(t),isInfix:!1,operand:e.expression,replace:t=>({...e,expression:t})}},jr=(e,t)=>e.high<t.low,Mr=e=>{let t=V(e.operator),[n,r]=e.args,i=Or(e),a=t=>{let n=e.location.range,i=Dr(t);return{...e,args:[t,r],location:n&&i?{...e.location,range:{...n,start:i}}:e.location}},o=(e,n)=>{let r=n?Ar(e):void 0;if(!r)return{kind:`Reduced`,isFinal:!1};let s=o(r.operand,Er(Or(r.operand),Or(e)));return s.kind===`Attached`?{kind:`Attached`,expression:kr(r.replace(s.expression),i)}:!s.isFinal&&(jr(t,r.operator)||r.isInfix&&t.fixity===`InfixLeft`&&r.operator.fixity===`InfixLeft`&&!jr(r.operator,t))?{kind:`Reduced`,isFinal:!jr(t,r.operator)}:{kind:`Attached`,expression:kr(r.replace(a(r.operand)),i)}},s=o(n,Er(Dr(n),Dr(e)));return s.kind===`Attached`?s.expression:e},Nr="use instead the class`E_visit.iter_concrete`",Pr=(t,n,r,i)=>{let a=n.split(`
+`),o=e=>({file:t,startLine:e.start.line,startColumn:e.start.column,endLine:e.end.line,endColumn:e.end.column+1}),s=e=>{let t={line:e.endLine-1,column:e.endColumn-1},n=e=>e===` `||e===`\r`;for(;t.line<a.length;){let e=a[t.line];for(;n(e[t.column]);)t.column++;if(t.column<e.length)break;t.line++,t.column=0}if(!(a[t.line]??``).startsWith(`(*{`,t.column))return e;for(let n=t.line;n<a.length;n++){let r=a[n].indexOf(`}*)`,n===t.line?t.column:0);if(r!==-1)return{...e,endLine:n+1,endColumn:r+4}}return e},c=(e,n)=>({file:t,startLine:n.line,startColumn:n.column,endLine:n.line,endColumn:n.column+e.length}),l=e=>e.range?o(e.range):{file:t,startLine:e.line,startColumn:e.column,endLine:e.line,endColumn:e.column+1},u=(e,t)=>{let n=Q(e),r=Cr[n];return _(r?{kind:`Internal`,builtin:r}:{kind:`Opaque`,name:n},{location:t})},d=(e,t,n,r)=>{if(e.startsWith(`<`)){let t=_({kind:`Opaque`,name:e},{location:n});return _({kind:`Bang`,expression:t,selectors:[]},{location:n})}let i=Cr[e];if(i&&t.length===0)return _({kind:`Internal`,builtin:i},{location:n});let a=e.split(`!`);if(a.length===1){let r=_({kind:`Opaque`,name:e},{location:n});return t.length===0?r:_({kind:`Apply`,operator:r,args:t},{location:n})}let o=r??a.map((e,n)=>n===a.length-1?t.length:0),s=o.map((e,t)=>o.slice(0,t).reduce((e,t)=>e+t,0)),c=e=>t.slice(s[e],s[e]+o[e]),l=_({kind:`Opaque`,name:a[0]},{location:n});return _({kind:`Bang`,expression:o[0]===0?l:_({kind:`Apply`,operator:l,args:c(0)},{location:n}),selectors:a.slice(1).map((e,t)=>({kind:`Label`,label:Q(e),args:c(t+1)}))},{location:n})},f=(t,n)=>t.map((r,i)=>{if(r.pattern.kind===`Tuple`)throw new e.M(`Unexpected tuple declaration`,{failure:Nr});let a=i>0&&t[i-1].set===r.set;return{name:r.pattern.name,level:`Constant`,domain:a?{kind:`Ditto`}:{kind:`Domain`,expression:g(r.set,n)}}}),p=(e,t)=>e.map((n,r)=>{let i=g(n.set,t);if(n.pattern.kind===`Tuple`)return{kind:`Tuple`,names:n.pattern.names,domain:i};let a=r>0&&e[r-1].set===n.set;return{kind:`Name`,name:n.pattern.name,domain:a?{kind:`Ditto`}:{kind:`Domain`,expression:i}}}),m=(t,n)=>{if(!i)throw new e.M(`Unexpected tuple declaration`,{failure:Nr});return _(t(),{location:n})},h=e=>e.some(e=>e.pattern.kind===`Tuple`),g=(t,n)=>{let r=l(t.location),i=e=>g(e,n),a=(e,t)=>e.length===2?$(e[0].location,e[1].location):e.length!==1||!e[0].location?r:t===`Prefix`?$({...r,endLine:r.startLine,endColumn:r.startColumn+1},e[0].location):t===`Postfix`?$({...r,startLine:r.endLine,startColumn:r.endColumn-1},e[0].location):r,o=(e,t)=>_({kind:`Apply`,operator:{kind:`Internal`,builtin:e},args:[t]},{location:a([t],`Prefix`)});switch(t.kind){case`Number`:return _({kind:`Num`,integer:t.text??String(t.value),fraction:``},{location:r});case`Decimal`:{let[e,n]=t.text.split(`.`);return _({kind:`Num`,integer:e,fraction:n},{location:r})}case`String`:return _({kind:`String`,value:t.value},{location:r});case`Identifier`:return d(t.name,[],r);case`Apply`:{if(t.args.length===2){let e=Mr(t);if(e!==t)return i(e)}let e=t.args.map(i),n=V(t.operator);return n.fixity===`Nonfix`?d(t.operator,e,r,t.argumentCounts):_({kind:`Apply`,operator:u(t.operator,void 0),args:e},{location:a(e,n.fixity)})}case`OperatorReference`:return u(t.operator,r);case`Lambda`:return _({kind:`Lambda`,params:t.params.map(e=>({name:e,shape:0})),body:i(t.body)},{location:r});case`And`:case`Or`:{let e=t.operands.map(i);if(t.isBulleted)return _({kind:`List`,bullet:t.kind,items:e},{location:r});let n=t.kind===`And`?`Conj`:`Disj`;return e.reduce((e,t)=>_({kind:`Apply`,operator:{kind:`Internal`,builtin:n},args:[e,t]},{location:$(e.location,t.location)}))}case`Prime`:{let e=i(t.expression);return _({kind:`Apply`,operator:{kind:`Internal`,builtin:`Prime`},args:[e]},{location:a([e],`Postfix`)})}case`Unchanged`:return o(`UNCHANGED`,i(t.expression));case`Enabled`:return o(`ENABLED`,i(t.expression));case`If`:return _({kind:`If`,condition:i(t.condition),consequent:i(t.consequent),alternative:i(t.alternative)},{location:r});case`Case`:return _({kind:`Case`,arms:t.arms.map(e=>({condition:i(e.condition),body:i(e.body)})),other:t.other&&i(t.other)},{location:r});case`Let`:return _({kind:`Let`,definitions:[...t.definitions,...t.instances??[]].sort((e,t)=>e.location.line-t.location.line||e.location.column-t.location.column).map(e=>y(e,n)),body:i(t.body)},{location:r});case`Forall`:case`Exists`:if(h(t.bounds)){let e=p(t.bounds,n),a=i(t.body);return m(()=>gr(t.kind,e,a),r)}return _({kind:`Quant`,quantifier:t.kind,bounds:f(t.bounds,n),body:i(t.body)},{location:r});case`UnboundedQuantifier`:{let e=i(t.body),n=t.quantifier;return t.isTemporal?_({kind:`Tquant`,quantifier:n,names:t.names,body:e},{location:r}):_({kind:`Quant`,quantifier:n,bounds:dr(t.names),body:e},{location:r})}case`Choose`:if(t.pattern.kind===`Tuple`){let e=t.pattern.names,n=t.set&&i(t.set),a=i(t.body);return m(()=>vr(e,n,a),r)}return _({kind:`Choose`,name:t.pattern.name,domain:t.set&&i(t.set),body:i(t.body)},{location:r});case`SetEnumeration`:return _({kind:`SetEnum`,elements:t.elements.map(i)},{location:r});case`SetFilter`:if(t.bound.pattern.kind===`Tuple`){let e=t.bound.pattern.names,n=i(t.bound.set),a=i(t.predicate);return m(()=>yr(e,n,a),r)}return _({kind:`SetSt`,name:t.bound.pattern.name,domain:i(t.bound.set),body:i(t.predicate)},{location:r});case`SetMap`:if(h(t.bounds)){let e=i(t.expression),a=p(t.bounds,n);return m(()=>xr(e,a),r)}return _({kind:`SetOf`,element:i(t.expression),bounds:f(t.bounds,n)},{location:r});case`Tuple`:return _({kind:`Tuple`,elements:t.elements.map(i)},{location:{...r,startLine:r.endLine,startColumn:r.endColumn-2}});case`FunctionConstruction`:if(h(t.bounds)){let e=p(t.bounds,n),a=i(t.body);return m(()=>Sr(e,a),r)}return _({kind:`Fcn`,bounds:f(t.bounds,n),body:i(t.body)},{location:r});case`FunctionSet`:return _({kind:`Arrow`,domain:i(t.domain),range:i(t.range)},{location:r});case`Record`:case`RecordSet`:return _({kind:t.kind===`Record`?`Record`:`Rect`,fields:t.fields.map(e=>({name:e.name,value:i(e.value)}))},{location:r});case`Except`:return _({kind:`Except`,function:i(t.function),specs:t.updates.map(e=>({trail:e.path.map(e=>e.kind===`Field`?{kind:`Dot`,field:e.name}:{kind:`Apply`,expression:e.args.length===1?i(e.args[0]):{kind:`Tuple`,elements:e.args.map(i)}}),value:g(e.value,!0)}))},{location:r});case`ExceptAt`:return _({kind:`At`,isExcept:n},{location:r});case`FunctionApplication`:return _({kind:`FcnApp`,function:i(t.function),args:t.args.map(i)},{location:r});case`FieldAccess`:return _({kind:`Dot`,expression:i(t.record),field:t.field},{location:r});case`Product`:return _({kind:`Product`,factors:t.factors.map(i)},{location:r});case`Always`:case`Eventually`:{let e=t.expression;return t.kind===`Always`&&e.kind===`BoxAction`?_({kind:`Tsub`,modal:`Box`,action:i(e.action),subscript:i(e.subscript)},{location:r}):t.kind===`Eventually`&&e.kind===`AngleAction`?_({kind:`Tsub`,modal:`Dia`,action:i(e.action),subscript:i(e.subscript)},{location:r}):o(t.kind===`Always`?`BoxTrue`:`Diamond`,i(e))}case`BoxAction`:case`AngleAction`:return _({kind:`Sub`,modal:t.kind===`BoxAction`?`Box`:`Dia`,action:i(t.action),subscript:i(t.subscript)},{location:r});case`WeakFairness`:case`StrongFairness`:return _({kind:`Fair`,fairness:t.kind===`WeakFairness`?`Weak`:`Strong`,subscript:i(t.subscript),action:i(t.action)},{location:r});case`Label`:return _({kind:`Parens`,expression:i(t.body),form:{kind:`Nlabel`,label:t.name,names:t.params}},{location:r});case`Subexpression`:{let[n,...a]=t.selectors;if(n.kind!==`Name`)throw new e.M(`Unexpected subexpression reference`);let o=_({kind:`Opaque`,name:n.name},{location:r}),s=n.args.length===0?o:_({kind:`Apply`,operator:o,args:n.args.map(i)},{location:r});return _({kind:`Bang`,expression:s,selectors:a.map(e=>{switch(e.kind){case`Name`:return{kind:`Label`,label:Q(e.name),args:e.args.map(i)};case`Operand`:return e.operand===`<<`?{kind:`Left`}:e.operand===`>>`?{kind:`Right`}:{kind:`Number`,value:e.operand};case`Bound`:return{kind:`Instance`,args:e.args.map(i)};case`At`:return{kind:`At`};case`Colon`:return{kind:`Down`}}})},{location:r})}}},v=e=>({location:o(e.definitionRange??e.instanceRange),args:e.params.map(e=>e.name),module:e.module,substitutions:e.substitutions.map(e=>({name:Q(e.name),expression:g(e.expression,!1)}))}),y=(t,n=!1)=>{let r=l(t.location);if(t.kind===`Instance`){if(t.name===void 0)throw new e.M(`Unexpected keyword INSTANCE`);return{kind:`Instance`,name:t.name,instance:v(t),location:r}}let i=Q(t.name,t.kind===`Operator`&&t.params.length===1&&t.name===`-`),a=g(t.body,n);if(t.kind===`Function`&&h(t.bounds)){let e=p(t.bounds,n);return{kind:`Operator`,name:i,body:m(()=>Sr(e,a),r),location:r}}if(t.kind===`Function`){let e=f(t.bounds,n);return{kind:`Operator`,name:i,body:_({kind:`Fcn`,bounds:e,body:a},{location:r}),location:r}}return t.params.length===0?{kind:`Operator`,name:i,body:a,location:r}:{kind:`Operator`,name:i,body:_({kind:`Lambda`,params:t.params.map(e=>({name:Q(e.name),shape:e.arity,...e.location&&{location:c(e.name,e.location)}})),body:a},{location:r}),location:r}},b=e=>{let t=l(e.location);return e.level===`Variable`?{kind:`Flex`,name:e.name,location:t}:{kind:`Fresh`,name:e.name,shape:e.arity,level:e.level,domain:e.set&&g(e.set,!1),domainVisibility:`Visible`,location:t}},x=e=>e.kind===`AssumeProve`?{context:e.assumptions.map(e=>{if(e.kind===`NewSymbol`)return b(e);if(e.kind===`AssumeProve`){let t=l(e.location);return{kind:`Fact`,expression:_({kind:`Sequent`,sequent:x(e)},{location:t}),visibility:`Visible`,location:t}}let t=S(e);return{kind:`Fact`,expression:t,visibility:`Visible`,location:t.location}}),active:g(e.conclusion,!1)}:{context:[],active:g(e,!1)},S=e=>{if(e.kind!==`Label`||e.params.length>0)return g(e,!1);let t=l(e.location);return _({kind:`Parens`,expression:g(e.body,!1),form:{kind:`Xlabel`,label:e.name,indices:[]}},{location:t})},C=t=>{if(t.kind===`ModuleFact`)throw new e.P(`MODULE facts in proof obligations are not supported`);let n=g(t,!1);return n.kind===`Bang`&&n.selectors.length===0?n.expression:n},w=t=>{let n=l(t.location);if(t.kind===`ModuleFact`)return{kind:`Dvar`,name:t.name,location:n};if(t.kind===`Identifier`)return{kind:`Dvar`,name:Q(t.name),location:n};if(t.kind===`OperatorReference`)return{kind:`Dvar`,name:Q(t.operator),location:n};throw new e.P(`This DEF clause in proof obligations is not supported`)},T=e=>({facts:e.facts.map(C),defs:e.defs.map(w)}),E=(e,t)=>{let n=e?e[2]:``;return n===``?{kind:`Unnamed`,level:t,id:Fe(r)}:{kind:`Named`,level:t,label:n,isAnonymous:!1}},D=(e,t,n)=>{if(!e)return{kind:`Omitted`,omission:`Implicit`,location:n};switch(e.kind){case`Obvious`:return{kind:`Obvious`,location:s(o(e.keyword))};case`Omitted`:return{kind:`Omitted`,omission:`Explicit`,location:o(e.keyword)};case`By`:return{kind:`By`,usable:T(e),isOnly:e.isOnly,location:o(e.keyword),step:{kind:`Unnamed`,level:t,id:0}};case`Steps`:{let n=e.steps.map(e=>wr.exec(e.token)),r=n[0],i=r&&r[1]!==`*`&&r[1]!==`+`?Number(r[1]):t,a=e.steps.slice(0,-1).map((e,t)=>te(e,E(n[t],i),i)),s=e.steps[e.steps.length-1],c=E(n[n.length-1],i),l=o(s.head),u=D(s.proof,i+1,l),d={proof:u,location:$(l,u.location),step:c};return{kind:`Steps`,steps:a,qed:d,location:a.reduce((e,t)=>$(e,t.location),d.location),step:d.step}}}},ee=e=>$(o(e.keyword),e.defs.length>0?l(e.defs[e.defs.length-1].location):void 0),te=(t,n,r)=>{let i=o(t.head),a=t.body,s=e=>{let a=D(t.proof,r+1,i);return{...e(a),location:$(i,a.location),step:n}},c=e=>({...e,location:i,step:n});switch(a.kind){case`Use`:case`Hide`:{let e=$(o({...t.head,end:t.head.start}),ee(a)),r=T(a);return a.kind===`Use`?{kind:`Use`,usable:r,isOnly:a.isOnly,location:e,step:n}:{kind:`Hide`,usable:r,location:e,step:n}}case`Instance`:throw new e.M(`Unexpected keyword INSTANCE`);case`Define`:return c({kind:`Define`,definitions:a.definitions.map(e=>y(e))});case`Have`:return c({kind:`Have`,expression:g(a.expression,!1)});case`Take`:return c({kind:`Take`,bounds:a.names.length>0?dr(a.names):f(a.bounds,!1)});case`Witness`:return c({kind:`Witness`,expressions:a.expressions.map(e=>g(e,!1))});case`Pick`:{let e=a.names.length>0?dr(a.names):f(a.bounds,!1),t=g(a.body,!1);return s(n=>({kind:`Pick`,bounds:e,expression:t,proof:n}))}case`Case`:{let e=g(a.expression,!1);return s(t=>({kind:`Pcase`,expression:e,proof:t}))}case`Assert`:{let e=x(a.statement);return s(t=>a.isSuffices?{kind:`Suffices`,sequent:e,proof:t}:{kind:`Assert`,sequent:e,proof:t})}case`Qed`:throw new e.P(`QED in the middle of a proof`)}},O=e=>({name:e.name,extendees:e.extends,extendeeLocations:e.extendsRanges.map(o),isImportant:!1,location:l(e.location),body:e.units.map(e=>{switch(e.kind){case`Constants`:case`Recursive`:return{kind:e.kind===`Constants`?`Constants`:`Recursives`,declarations:e.declarations.map(e=>({name:Q(e.name),shape:e.arity})),location:l(e.declarations[0].location)};case`Variables`:return{kind:`Variables`,names:e.declarations.map(e=>e.name),location:l(e.declarations[0].location)};case`Definition`:return{kind:`Definition`,definition:y(e.definition),whereDefined:`User`,visibility:`Hidden`,isLocal:e.definition.isLocal,location:l(e.definition.location)};case`Instance`:{let t=e.instance,n=l(t.location);return t.name===void 0?{kind:`Anoninst`,instance:v(t),isLocal:t.isLocal,location:n}:{kind:`Definition`,definition:y(t),whereDefined:`User`,visibility:`Hidden`,isLocal:t.isLocal,location:o(t.instanceRange)}}case`Assumption`:return{kind:`Axiom`,name:e.assumption.name,expression:g(e.assumption.expression,!1),location:l(e.assumption.location)};case`Theorem`:{let t=e.theorem,n=l(t.location),r=s(n);return{kind:`Theorem`,name:t.name,sequent:x(t.statement),axiomCount:0,proof:D(t.proof,0,{...r,startLine:r.endLine,startColumn:r.endColumn}),location:n}}case`Use`:return{kind:`Mutate`,mode:e.use.kind,isSuppressed:!1,usable:T(e.use),location:ee(e.use)};case`Module`:return{kind:`Submod`,module:{...O(e.module),isImportant:!0}}}})});return{convertModule:O}},Fr={start:0,end:1/0},Ir=/-{4,} *MODULE/,Lr=`Unexpected EOF`,Rr=e=>e?`${e.startLine}:${e.startColumn}:${e.endLine}:${e.endColumn}`:``,zr=t=>{let n=e.O(t),r=t.split(`
+`),i=n.at(-1)?.line??r.length,a=r.slice(0,i-1).reduce((e,t)=>e+t.length+1,0)+r[i-1].indexOf(`====`),o=t.indexOf(`	`,t.search(Ir));if(o===-1||o>=a)return;let s=t.slice(0,o).split(`
+`).length,c=o-t.lastIndexOf(`
+`,o-1),l=n.findLast(e=>e.kind!==`End`&&(e.line<s||e.line===s&&e.column<c));return{offset:o,line:s,column:c,end:{reason:Lr,line:l?.line??s,column:l?l.endColumn+1:c,isEnd:!0}}},Br=t=>{try{return t()}catch(t){if(!(t instanceof e.N)||!t.failure)throw t;return t.failure}},Vr=e=>typeof e==`object`&&!!e&&`reason`in e,Hr=t=>{let n=Br(()=>zr(t));if(Vr(n))return[n];let r=Br(()=>e.v(n?t.slice(0,n.offset):t));return n&&(!Vr(r)||r.isEnd)?[{reason:`Unexpected TAB character. TLAPS does not handle TAB characters in source files.`,line:n.line,column:n.column,isEnd:!1},Vr(r)&&r.reason===Lr?r:n.end]:Vr(r)?[r]:r},Ur=(t,n,r,i,a)=>{if(!Ir.test(t.source))throw new e.M(`No tokens in file`);let o=Hr(t.source);if(Array.isArray(o)){o.forEach(e=>{let n=`File ${JSON.stringify(t.file)}, line ${e.line}, character ${e.column}\n${e.reason}`;i({text:n,channel:`stderr`}),i({text:`${n}\n`,channel:`toolboxOnly`})});let n=`Could not parse ${JSON.stringify(t.file)} successfully.`;throw i({text:`${a}Error: ${n}`,channel:`stderr`}),new e.M(n,{failure:`Module.Parser.parse_file`})}let s=Pr(t.file,t.source,n,r).convertModule(o),c=t.file.slice(t.file.lastIndexOf(`/`)+1),l=c.replace(/\.tla$/,``);return s.name===l?s:(i({text:`${f(s.location)}Warning: module name ${JSON.stringify(s.name)} does not match file name ${JSON.stringify(c)}.`,channel:`toolbox`}),{...s,name:l})},Wr=t=>{let n=new Map([...t].map(([e,t])=>[e,Hn(t).dependencies])),r=/* @__PURE__ */ new Set,i=[],a=o=>{if(r.has(o))return;r.add(o);let s=t.get(o);if(!s)throw new e.M(`Module "${o}" not found`);(n.get(o)??[]).forEach(a),i.push(s)};return[...t.keys()].sort(Wn).forEach(a),i},Gr=(e,t,n)=>t.length===0?[]:[`    ${e}_proofs_count = ${t.length}`,...t.map((t,r)=>`    ${e}_proof_${n+r+1} at ${c(t)}`)],Kr=(e,t,n)=>{let r=e.location;return[`  ---- incomplete proof of theorem at ${r?c({...r,endLine:r.startLine,endColumn:r.startColumn}):`<unknown location>`} ----`,...Gr(`missing`,e.absent,t),...Gr(`omitted`,e.omitted,n),`  ====`]},qr=e=>{let t=e.summary,n=t.theorems.reduce((e,t)=>t.absent.length+t.omitted.length===0?e:{lines:[...e.lines,...Kr(t,e.missing,e.omitted)],missing:e.missing+t.absent.length,omitted:e.omitted+t.omitted.length},{lines:[],missing:0,omitted:0});return[`---- summary of module ${JSON.stringify(e.name)} ----`,`  obligations_count = ${t.total}`,...t.absent.length>0?[`  missing_proofs_count = ${t.absent.length}`]:[],...t.omitted.length>0?[`  omitted_proofs_count = ${t.omitted.length}`]:[],...n.lines,`====`].join(`
+`)},Jr=(t,n,r={})=>{let i=r.lines??Fr,a=r.onWarning??(()=>{}),o={value:0},s=new Map(In);t.forEach(e=>{let t={...Ur(e,o,!0,a,`File "<unknown>":
+`),isImportant:!0};s.set(t.name,t)});let c=[...s.values()].sort((e,t)=>Wn(e.name,t.name)),l=/* @__PURE__ */ new Map,f=/* @__PURE__ */ new Set;for(let e=0;e<c.length;e++){let t=Hn(c[e]);t.submodules.forEach((e,t)=>{f.add(t),s.has(t)||s.set(t,e)});for(let e of t.dependencies){if(s.has(e)&&!In.has(e))continue;let r=n(e);if(!r){!s.has(e)&&!l.has(e)&&l.set(e,t.locations.get(e));continue}let i=Ur(r,o,!1,a,u(t.locations.get(e)));s.set(e,i),c.push(i)}}let p=[...l.keys()].filter(e=>!f.has(e)).sort(Wn);if(p.forEach(e=>a(d(l.get(e),`Unknown module ${JSON.stringify(e)}`))),p.length>0)throw new e.M(`Unknown module ${JSON.stringify(p[0])}`,{failure:`Module.Parser.load_module`});let m={anonymizer:ze(o,(e,t)=>ar(m,e,t),a),generator:rn(o,new Set(t.map(e=>e.file)),i,a),salts:{value:0},latestModules:/* @__PURE__ */ new Map,onWarning:a},h=Wr(s).map(e=>e.isStandard?e:Vn(s,e,/* @__PURE__ */ new Set)),g=new Map(h.map(e=>[e.name,e]));return h.flatMap(e=>{if(e.isStandard)return[];let t=or(m,g,void 0,e);if(!e.isImportant)return[];let n=sr(m,[],t),r=n.obligations.flatMap((e,t)=>{let n=e.location;if(e.kind.kind===`Omitted`||n&&(n.startLine<i.start||n.endLine>i.end))return[];let r=e.kind.kind===`Error`?e.kind.message:`${Nt(e.sequent)}\n`;return[{id:t+1,location:Rr(n),text:r}]});return[{name:e.name,location:e.location,obligations:r,summary:n.summary}]})},Yr={success:e.L.success,"assumption-violation":e.L.assumptionViolation,deadlock:e.L.deadlock,"invariant-violation":e.L.safetyViolation,"property-violation":e.L.safetyViolation,"liveness-violation":e.L.livenessViolation,"postcondition-violation":e.L.assumptionViolation,error:e.L.error},Xr=s(`tla-ts <Spec.tla|Spec.cfg|glob>... {options}`,[{flag:`-config <Spec.cfg>`},{flag:`-deadlock`},{flag:`-lncheck <final|default>`},{flag:`-seed <num>`},{flag:`-workers <count|auto>`}]),Zr=s(`tla-ts prove {options} <Module.tla|glob>...`,[{flag:`-N`,isRequired:!0},{flag:`--toolbox <start> <end>`},{flag:`--line <num>`},{flag:`--printallobs`},{flag:`--summary`},{flag:`--strict`},{flag:`-I <directory>`,isRepeatable:!0}]),Qr=[`Usage: ${Xr.usage}`,`       ${Zr.usage}`,`       tla-ts prove [<tlapm option>]... <Module.tla|glob>...`].join(`
+`),$r=/[*?[{]/,ei=e=>e.flatMap(e=>$r.test(e)?(0,n.globSync)(e).sort().map(e=>({path:e,isGlobbed:!0})):[{path:e,isGlobbed:!1}]),ti=e=>/^[+-]?\d+$/.test(e)&&BigInt.asIntN(64,BigInt(e))===BigInt(e),ni=e=>e?e[0]===`auto`?(0,a.availableParallelism)():Math.max(1,Number.parseInt(e[0],10)||1):1,ri=t=>{let n=Object.entries(t);n.forEach(([t,r])=>console.log(`${n.length===1?``:`/\\ `}${t} = ${e.E(e.C(r))}`)),console.log(``)},ii=(e,t=`Error: The behavior up to this point is:`)=>{e.length>0&&console.log(t),e.forEach((e,t)=>{console.log(`State ${t+1}: <${e.label??e.action??`Initial predicate`}>`),ri(e.state)})},ai=t=>{if(t.failure)console.log(`Error: ${t.failure.message}`),t.failure.initialState&&(console.log(`While working on the initial state:`),ri(t.failure.initialState)),ii(t.failure.trace);else if(t.violation){let e=t.violation,n=e.name,r=e.loopStart,i=r===void 0&&e.trace.length===1&&(t.status===`invariant-violation`||t.status===`liveness-violation`),a={success:``,error:``,"assumption-violation":e.message?`Error: Evaluating assumption ${n} failed.\n${e.message}`:`Error: Assumption ${n} is false.`,deadlock:`Error: Deadlock reached.`,"invariant-violation":i?`Error: Invariant ${n} is violated by the initial state:`:`Error: Invariant ${n} is violated.`,"property-violation":`Error: Property ${n} is violated.`,"liveness-violation":r===void 0?i?`Error: Property ${n} is violated by the initial state:`:`Error: Action property ${n} is violated.`:`Error: Temporal property ${n} was violated.\n`,"postcondition-violation":`Error: ${e.message??`Postcondition ${n} is false.`}`}[t.status];if(e.counts&&console.log(e.counts),console.log(a),i)ri(e.trace[0].state);else if(r===void 0)ii(e.trace);else{ii(e.trace,`Error: The following behavior constitutes a counter-example:
+`);let t=r===e.trace.length-1;console.log(t?`State ${r+2}: Stuttering`:`Back to state ${r+1}${e.loopLabel?`: <${e.loopLabel}>\n`:``}`)}let o=e.unwitnessed;if(o?.counts&&console.log(o.counts),o&&console.log(`Error: ${o.message}`),i||t.status===`assumption-violation`)return}else{let n=e.f(t.distinctStates,t.generatedStates);if(console.log(`Model checking completed. No error has been found.`),console.log(`  Estimates of the probability that TLC did not check all reachable states`),console.log(`  because two distinct states had the same fingerprint:`),console.log(`  calculated (optimistic):  val = ${e.l(n)}`),t.fingerprintDistance!==void 0){let n=e.u(t.fingerprintDistance);console.log(`  based on the actual fingerprints:  val = ${e.l(n)}`)}}console.log(`${t.generatedStates} states generated, ${t.distinctStates} distinct states found, ${t.queuedStates} states left on queue.`),console.log(`The depth of the complete state graph search is ${t.depth}.`);let n=t.outDegrees&&e.p(t.outDegrees);n&&console.log(n)},oi=async(r,a)=>{if(!(0,n.existsSync)(r))return console.error(`Cannot find the specification file ${r}`),e.L.configParseError;let o=a.get(`-config`)?.[0]??(a.has(`-config`)?void 0:r.replace(/\.tla$/,`.cfg`));if(!o||!(0,n.existsSync)(o))return console.error(`Cannot find the configuration file ${o??``}`),e.L.configParseError;let s=e.D((0,n.readFileSync)(o,`utf8`));a.has(`-deadlock`)&&(s.checkDeadlock=!1);let c=a.has(`-seed`)?a.get(`-seed`)?.[0]:`0`;if(c===void 0)return console.error(`Error: seed required.`),1;if(!ti(c))return console.error(`Error: An integer for seed required. But encountered ${c}`),1;let l=a.has(`-lncheck`)?a.get(`-lncheck`)?.[0]?.toLowerCase():`default`;if(l===void 0)return console.error(`Error: expect a strategy such as final for -lncheck option.`),1;let u=(0,i.dirname)(r);console.log(`Checking ${(0,i.basename)(r)} with ${(0,i.basename)(o)}`);let d=await t.t({workers:ni(a.get(`-workers`)),livenessCheck:[`final`,`seqfinal`,`off`].includes(l)?`final`:`default`,seed:BigInt(c),source:(0,n.readFileSync)(r,`utf8`),config:s,onPause:()=>(0,n.readSync)(0,Buffer.alloc(1)),loadModule:e=>{let t=(0,i.join)(u,`${e}.tla`);return(0,n.existsSync)(t)?(0,n.readFileSync)(t,`utf8`):void 0},loadClass:e=>{let t=(0,i.join)(u,`${e}.class`);return(0,n.existsSync)(t)?(0,n.readFileSync)(t):void 0},readFile:e=>(0,n.existsSync)(e)?(0,n.readFileSync)(e,`utf8`):void 0,writeFile:(e,t)=>{(0,n.mkdirSync)((0,i.dirname)((0,i.resolve)(e)),{recursive:!0}),(0,n.writeFileSync)(e,t)}});return ai(d),d.failure?.exitCode??Yr[d.status]},si=t=>{if(t instanceof e.k||t instanceof e.j)return console.log(`Error: ${t.message}`);console.error(`${t.name}: ${t.message}`)},ci=async t=>{try{return await t()}catch(t){if(!(t instanceof e.A))throw t;return si(t),e.I(t)}},li=async(t,n)=>{let r=[];for(let[e,i]of t.entries())e>0&&console.log(``),r.push(await ci(()=>n(i)));return r.find(t=>t!==e.L.success)??e.L.success},ui=()=>(process.env.PATH??``).split(i.delimiter).map(e=>(0,i.join)(e,`tlapm`)).filter(e=>(0,n.existsSync)(e)),di=()=>ui().map(e=>(0,i.join)((0,i.dirname)((0,i.dirname)((0,n.realpathSync)(e))),`lib/tlapm/stdlib`)).find(e=>(0,n.existsSync)(e)),fi=e=>e.flatMap(e=>$r.test(e)?(0,n.globSync)(e).sort():[e]),pi=e=>{let t=ui()[0];return t===void 0?(console.error(`Error: tla-ts prove runs tlapm to prove obligations, but tlapm isn't on your PATH. Install tlapm, or pass -N to only generate the obligations.`),1):(0,r.spawnSync)(t,fi(e),{stdio:`inherit`}).status??1},mi=e=>(0,n.existsSync)(e)?{file:e,source:(0,n.readFileSync)(e,`utf8`)}:void 0,hi=e=>console.error(`@!!BEGIN\n${e.map(e=>`@!!${e}\n`).join(``)}@!!END\n`),gi=e=>/^[+,\-./0-9:=@A-Z_a-z]+$/.test(e)?e:`'${e.replaceAll(`'`,`'\\''`)}'`,_i=e=>{let t=/* @__PURE__ */ new Date,n=e=>String(e).padStart(2,`0`),r=`${t.getFullYear()}-${n(t.getMonth()+1)}-${n(t.getDate())}`,i=`${n(t.getHours())}:${n(t.getMinutes())}:${n(t.getSeconds())}`;console.log(`\n\\* TLAPM version 5f5037f\n\\* launched at ${r} ${i} with command line:\n\\* ${[`tla-ts`,`prove`,...e].map(gi).join(` `)}\n`)},vi={incomplete:11,emptyTarget:12},yi=(e,t,n)=>{let r=e.summary;n||(r.absent.forEach(e=>console.error(`Missing proof at ${l(e)}`)),r.omitted.forEach(e=>console.error(`Omitted proof at ${l(e)}`)));let i=r.absent.length+r.omitted.length>0;i&&console.error(`${u(e.location)}[ERROR]: Proof incomplete in module ${JSON.stringify(e.name)}: ${r.absent.length} missing, ${r.omitted.length} omitted proof step(s).`);let a=t&&e.obligations.length===0;return a&&console.error(`${u(e.location)}[ERROR]: No proof obligation found for the selected target.`),[...i?[vi.incomplete]:[],...a?[vi.emptyTarget]:[]]},bi=t=>{try{return t()}catch(t){if(!(t instanceof e.M))throw t;console.error(` tlapm ending abnormally with ${t.exception}\n`);return}},xi=t=>{if(!t.includes(`-N`)&&!t.includes(`--summary`))return pi(t);let r=Zr.parse(t),a=r.unknown[0];if(a!==void 0)return console.error(`Error: tla-ts prove does not support the tlapm option ${a}.`),1;if(r.incomplete)return console.error(`Error: option '${r.incomplete.name}' needs an argument.`),1;let o=r.options.find(e=>e.name!==`-I`&&e.values.some(e=>!/^-?\d+$/.test(e)));if(o)return console.error(`Error: option '${o.name}' expects an integer.`),1;let s=fi(r.positionals),c=s.map(e=>e.endsWith(`.tla`)?e:`${e}.tla`);if(c.length===0)return console.error(Qr),1;let l=r.has(`--toolbox`)||r.has(`--line`);l&&_i(t);let u=r.options.reduce((e,t)=>{let[n,r]=t.values.map(Number);return t.name===`--toolbox`?{start:n,end:r===0?1/0:r}:t.name===`--line`?n===0?Fr:{start:n,end:n}:e},Fr),d=di(),f=r.options.flatMap(e=>e.name===`-I`?e.values:[]),p=c.reduce((e,t)=>e.includes((0,i.dirname)(t))?e:[(0,i.dirname)(t),...e],[`.`,...d?[d]:[],...f.toReversed()]),m=bi(()=>{let t=c.findIndex(e=>!(0,n.existsSync)(e));if(t!==-1){let n=s[t];throw console.error(`File "<unknown>":\nError: File ${JSON.stringify(n)} not found`),new e.M(`File ${n} not found`,{failure:`Module.Parser.parse_file`})}return Jr(c.map(e=>({file:`./${e}`,source:(0,n.readFileSync)(e,`utf8`)})),e=>p.map(t=>mi(`${t}/${e}.tla`)).find(Boolean),{lines:u,onWarning:e=>{if(e.channel===`stdout`)return console.log(e.text);let t=e.channel===`toolbox`||e.channel===`toolboxOnly`;if(l&&t)return hi([`type:warning`,`msg:${e.text}`]);e.channel!==`toolboxOnly`&&console.error(e.text)}})});if(!m)return 3;let h=m.flatMap(e=>(r.has(`--summary`)&&console.log(qr(e)),l&&(e.obligations.forEach(e=>hi([`type:obligation`,`id:${e.id}`,`loc:${e.location}`,`status:to be proved`,...r.has(`--printallobs`)?[`obl:${e.text}`]:[]])),hi([`type:obligationsnumber`,`count:${e.obligations.length}`])),r.has(`--strict`)?yi(e,u.start>0||u.end<1/0,r.has(`--summary`)):[]));return h.includes(vi.incomplete)?vi.incomplete:h[0]??e.L.success},Si=async e=>{if(e[0]===`prove`)return ci(()=>xi(e.slice(1)));let t=Xr.parse(e),r=ei(t.positionals),i=t.has(`-config`),a=r.map(e=>({...e,path:e.path.replace(/\.cfg$/,`.tla`)})).filter(e=>e.path.endsWith(`.tla`)&&(!e.isGlobbed||i||(0,n.existsSync)(e.path.replace(/\.tla$/,`.cfg`)))).map(e=>e.path);return a.length===0?(console.error(Qr),1):i&&a.length>1?(console.error(`Error: -config applies to one specification, but several were given.`),1):li([...new Set(a)],e=>oi(e,t))},Ci=async()=>{process.exitCode=await Si(process.argv.slice(2))};exports.runCli=Ci;