tla-ts 0.0.2 → 0.0.3-dev.a50fc89

package/dist/run-cli.js

@@ -6,5 +6,23 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
-import{D as e,E as t,M as n,N as r,O as i,S as a,T as o,f as s,k as c,l,p as u,u as d}from"./transfer.js";import{t as f}from"./parallel.js";import{existsSync as p,mkdirSync as m,readFileSync as h,readSync as g,writeFileSync as _}from"node:fs";import{basename as v,dirname as y,join as b,resolve as x}from"node:path";import{availableParallelism as S}from"node:os";const C={success:r.success,"assumption-violation":r.assumptionViolation,deadlock:r.deadlock,"invariant-violation":r.safetyViolation,"property-violation":r.safetyViolation,"liveness-violation":r.livenessViolation,"postcondition-violation":r.assumptionViolation,error:r.error},w=e=>/^[+-]?\d+$/.test(e)&&BigInt.asIntN(64,BigInt(e))===BigInt(e),T=e=>{let t=e.indexOf(`-workers`);if(t===-1)return 1;let n=e[t+1];return n===`auto`?S():Math.max(1,Number.parseInt(n,10)||1)},E=e=>{let t=Object.entries(e);t.forEach(([e,n])=>console.log(`${t.length===1?``:`/\\ `}${e} = ${o(a(n))}`)),console.log(``)},D=(e,t=`Error: The behavior up to this point is:`)=>{e.length>0&&console.log(t),e.forEach((e,t)=>{console.log(`State ${t+1}: <${e.label??e.action??`Initial predicate`}>`),E(e.state)})},O=e=>{if(e.failure)console.log(`Error: ${e.failure.message}`),e.failure.initialState&&(console.log(`While working on the initial state:`),E(e.failure.initialState)),D(e.failure.trace);else if(e.violation){let t=e.violation,n=t.name,r=t.loopStart,i=r===void 0&&t.trace.length===1&&(e.status===`invariant-violation`||e.status===`liveness-violation`),a={success:``,error:``,"assumption-violation":t.message?`Error: Evaluating assumption ${n} failed.\n${t.message}`:`Error: Assumption ${n} is false.`,deadlock:`Error: Deadlock reached.`,"invariant-violation":i?`Error: Invariant ${n} is violated by the initial state:`:`Error: Invariant ${n} is violated.`,"property-violation":`Error: Property ${n} is violated.`,"liveness-violation":r===void 0?i?`Error: Property ${n} is violated by the initial state:`:`Error: Action property ${n} is violated.`:`Error: Temporal property ${n} was violated.\n`,"postcondition-violation":`Error: ${t.message??`Postcondition ${n} is false.`}`}[e.status];if(t.counts&&console.log(t.counts),console.log(a),i)E(t.trace[0].state);else if(r===void 0)D(t.trace);else{D(t.trace,`Error: The following behavior constitutes a counter-example:
-`);let e=r===t.trace.length-1;console.log(e?`State ${r+2}: Stuttering`:`Back to state ${r+1}${t.loopLabel?`: <${t.loopLabel}>\n`:``}`)}let o=t.unwitnessed;if(o?.counts&&console.log(o.counts),o&&console.log(`Error: ${o.message}`),i||e.status===`assumption-violation`)return}else{let t=s(e.distinctStates,e.generatedStates);if(console.log(`Model checking completed. No error has been found.`),console.log(`  Estimates of the probability that TLC did not check all reachable states`),console.log(`  because two distinct states had the same fingerprint:`),console.log(`  calculated (optimistic):  val = ${l(t)}`),e.fingerprintDistance!==void 0){let t=d(e.fingerprintDistance);console.log(`  based on the actual fingerprints:  val = ${l(t)}`)}}console.log(`${e.generatedStates} states generated, ${e.distinctStates} distinct states found, ${e.queuedStates} states left on queue.`),console.log(`The depth of the complete state graph search is ${e.depth}.`);let t=e.outDegrees&&u(e.outDegrees);t&&console.log(t)},k=async e=>{let n=e.find((t,n)=>t.endsWith(`.tla`)&&e[n-1]!==`-config`);if(!n)return console.error(`Usage: tla-ts <Spec.tla> [-config <Spec.cfg>] [-deadlock] [-lncheck <final|default>] [-seed <num>] [-workers <count|auto>]`),1;if(!p(n))return console.error(`Cannot find the specification file ${n}`),r.configParseError;let i=e.indexOf(`-config`),a=i===-1?n.replace(/\.tla$/,`.cfg`):e[i+1];if(!a||!p(a))return console.error(`Cannot find the configuration file ${a??``}`),r.configParseError;let o=t(h(a,`utf8`));e.includes(`-deadlock`)&&(o.checkDeadlock=!1);let s=e.indexOf(`-seed`),c=s===-1?`0`:e[s+1];if(c===void 0)return console.error(`Error: seed required.`),1;if(!w(c))return console.error(`Error: An integer for seed required. But encountered ${c}`),1;let l=e.indexOf(`-lncheck`),u=l===-1?`default`:e[l+1]?.toLowerCase();if(u===void 0)return console.error(`Error: expect a strategy such as final for -lncheck option.`),1;let d=y(n);console.log(`Checking ${v(n)} with ${v(a)}`);let S=await f({workers:T(e),livenessCheck:[`final`,`seqfinal`,`off`].includes(u)?`final`:`default`,seed:BigInt(c),source:h(n,`utf8`),config:o,onPause:()=>g(0,Buffer.alloc(1)),loadModule:e=>{let t=b(d,`${e}.tla`);return p(t)?h(t,`utf8`):void 0},loadClass:e=>{let t=b(d,`${e}.class`);return p(t)?h(t):void 0},readFile:e=>p(e)?h(e,`utf8`):void 0,writeFile:(e,t)=>{m(y(x(e)),{recursive:!0}),_(e,t)}});return O(S),S.failure?.exitCode??C[S.status]},A=t=>{if(t instanceof e||t instanceof c)return console.log(`Error: ${t.message}`);console.error(`${t.name}: ${t.message}`)},j=async()=>{try{process.exitCode=await k(process.argv.slice(2))}catch(e){if(!(e instanceof i))throw e;A(e),process.exitCode=n(e)}};export{j as runCli};
+import{A as e,C as t,D as n,E as r,F as i,I as a,L as o,M as s,N as c,O as l,P as u,f as d,j as f,k as p,l as m,p as h,u as g,v as _}from"./transfer.js";import{t as v}from"./parallel.js";import{existsSync as y,globSync as ee,mkdirSync as b,readFileSync as x,readSync as S,realpathSync as C,writeFileSync as te}from"node:fs";import{spawnSync as ne}from"node:child_process";import{basename as w,delimiter as T,dirname as E,join as re,resolve as ie}from"node:path";import{availableParallelism as ae}from"node:os";const oe=e=>{let t=e.isRequired?e.flag:`[${e.flag}]`;return e.isRepeatable?`${t}...`:t},se=(e,t)=>{let n=new Map(t.map(e=>{let[t,...n]=e.flag.split(` `);return[t,n.length]}));return{usage:e.replace(`{options}`,t.map(oe).join(` `)),parse:e=>{let t=[],r=[],i=[];for(let a=0;a<e.length;a++){let o=n.get(e[a]);o===void 0?(e[a].startsWith(`-`)?i:r).push(e[a]):(t.push({name:e[a],values:e.slice(a+1,a+1+o)}),a+=o)}return{options:t,positionals:r,unknown:i,incomplete:t.find(e=>e.values.length<(n.get(e.name)??0)),has:e=>t.some(t=>t.name===e),get:e=>t.findLast(t=>t.name===e)?.values}}}},ce=e=>{let t=e.endColumn-1;return e.startLine===e.endLine?e.startColumn>=t?`line ${e.startLine}, character ${e.startColumn}`:`line ${e.startLine}, characters ${e.startColumn}-${t}`:`line ${e.startLine}, character ${e.startColumn} to line ${e.endLine}, character ${t}`},le=e=>`File ${JSON.stringify(e.file)}, ${ce(e)}`,ue=e=>`${e?le(e):`<unknown location>`}:\n`,D=(e,t)=>({text:`${ue(e)}Error: ${t}`,channel:`stderr`}),de=e=>e?`${le(e)} :\n`:``,O=e=>({kind:`Shift`,amount:e}),fe=(e,t)=>({kind:`Cons`,expression:e,rest:t}),pe=(e,t)=>e.reduce((e,t)=>fe(t,e),t),k=(e,t)=>t.kind===`Bump`?{kind:`Bump`,amount:t.amount+e,rest:t.rest}:{kind:`Bump`,amount:e,rest:t},A=(e,t)=>{let n=t.location?{...e,location:t.location}:e;return t.isAtomic?{...n,isAtomic:!0}:n},me=e=>{switch(e.kind){case`Fresh`:case`Flex`:return e.name;case`Defn`:return e.definition.name;case`Fact`:return}},j=(e,t,n)=>A({kind:`Apply`,operator:A({kind:`Internal`,builtin:e},n),args:t},n),he=e=>e.context.length===0?e.active:{kind:`Sequent`,sequent:e},M=(e,t)=>({hyp:t,rest:e,size:(e?.size??0)+1}),ge=(e,t)=>t.reduce(M,e),_e=e=>{let t=[];for(let n=e;n;n=n.rest)t.push(n.hyp);return t.reverse()},ve=(e,t)=>{let n=0;for(let r=e;r;r=r.rest){if(me(r.hyp)===t)return{depth:n,hyp:r.hyp};n++}},ye=(e,t)=>{let n=e;for(let e=0;e<t&&n;e++)n=n.rest;return n},N=(e,t,n)=>{let r=[];return[t.reduce((e,t)=>{let[i,a]=n(e,t);return r.push(a),i},e),r]},P=(e,t,n=0)=>({kind:`Fresh`,name:e,shape:n,level:t,domain:void 0,domainVisibility:`Visible`}),be=(e,t)=>({kind:`Fresh`,name:e,shape:0,level:`Constant`,domain:t,domainVisibility:`Visible`}),xe=(e,t,n)=>{switch(e.kind){case`Shift`:return A({kind:`Ix`,index:e.amount+t},n);case`Cons`:return t===1?A(we(e.expression),n):xe(e.rest,t-1,n);case`Compose`:return F(e.outer,xe(e.inner,t,n));case`Bump`:return t<=e.amount?A({kind:`Ix`,index:t},n):F(O(e.amount),xe(e.rest,t-e.amount,n))}},Se=(e,t)=>t.map(t=>F(e,t)),Ce=(e,t)=>{if(e.kind===`Lambda`){if(e.params.length!==t.length)throw new s(`Arity mismatch`);return we(F(pe(t,O(0)),e.body))}return e.kind===`Apply`?{kind:`Apply`,operator:e.operator,args:[...e.args,...t]}:t.length===0?we(e):{kind:`Apply`,operator:e,args:t}},we=e=>{if(!e.location&&!e.isAtomic)return e;let{location:t,isAtomic:n,...r}=e;return r},Te=(e,t)=>[k(t.length,e),Fe(t,t=>F(e,t))],Ee=(e,t)=>{switch(t.kind){case`Recursive`:case`Operator`:case`Bpragma`:return Re(t,t=>F(e,t));case`Instance`:{let n=k(t.instance.args.length,e);return{...t,instance:{...t.instance,substitutions:t.instance.substitutions.map(e=>({name:e.name,expression:F(n,e.expression)}))}}}}},De=(e,t)=>{switch(t.kind){case`Fresh`:return t.domain?{...t,domain:F(e,t.domain)}:t;case`Flex`:return t;case`Defn`:return{...t,definition:Ee(e,t.definition)};case`Fact`:return{...t,expression:F(e,t.expression)}}},Oe=(e,t)=>{let[n,r]=N(e,t.context,(e,t)=>[k(1,e),De(e,t)]);return{context:r,active:F(n,t.active)}},F=(e,t)=>{let n=t=>F(e,t);switch(t.kind){case`Internal`:case`Opaque`:case`String`:case`Num`:case`At`:return t;case`Ix`:return xe(e,t.index,t);case`Apply`:return A(Ce(n(t.operator),Se(e,t.args)),t);case`Bang`:return{...t,expression:n(t.expression),selectors:t.selectors.map(e=>Ie(e,n))};case`Lambda`:return{...t,body:F(k(t.params.length,e),t.body)};case`Let`:{let[n,r]=N(e,t.definitions,(e,t)=>[k(1,e),Ee(e,t)]);return{...t,definitions:r,body:F(n,t.body)}}case`Sequent`:return{...t,sequent:Oe(e,t.sequent)};case`With`:return{...t,expression:n(t.expression)};case`If`:return{...t,condition:n(t.condition),consequent:n(t.consequent),alternative:n(t.alternative)};case`List`:return{...t,items:Se(e,t.items)};case`Quant`:{let[n,r]=Te(e,t.bounds);return{...t,bounds:r,body:F(n,t.body)}}case`Tquant`:return{...t,body:F(k(t.names.length,e),t.body)};case`Choose`:return{...t,domain:t.domain&&n(t.domain),body:F(k(1,e),t.body)};case`SetSt`:return{...t,domain:n(t.domain),body:F(k(1,e),t.body)};case`SetOf`:{let[n,r]=Te(e,t.bounds);return{...t,bounds:r,element:F(n,t.element)}}case`SetEnum`:return{...t,elements:Se(e,t.elements)};case`Arrow`:return{...t,domain:n(t.domain),range:n(t.range)};case`Fcn`:{let[n,r]=Te(e,t.bounds);return{...t,bounds:r,body:F(n,t.body)}}case`FcnApp`:return{...t,function:n(t.function),args:Se(e,t.args)};case`Product`:return{...t,factors:Se(e,t.factors)};case`Tuple`:return{...t,elements:Se(e,t.elements)};case`Rect`:case`Record`:return{...t,fields:t.fields.map(e=>({name:e.name,value:n(e.value)}))};case`Except`:return{...t,function:n(t.function),specs:Le(t.specs,n)};case`Dot`:return{...t,expression:n(t.expression)};case`Sub`:case`Tsub`:return{...t,action:n(t.action),subscript:n(t.subscript)};case`Fair`:return{...t,subscript:n(t.subscript),action:n(t.action)};case`Case`:return{...t,arms:t.arms.map(e=>({condition:n(e.condition),body:n(e.body)})),other:t.other&&n(t.other)};case`Parens`:return{...t,expression:n(t.expression)}}},I=(e,t)=>e===0?t:F(O(e),t),L=(e,t,n)=>e.length===t.length&&e.every((e,r)=>n(e,t[r])),ke=(e,t)=>{let n=new Map(e.map(e=>[e.name,e.value])),r=new Map(t.map(e=>[e.name,e.value]));if(n.size!==r.size)return!1;for(let[e,t]of n){let n=r.get(e);if(!n||!R(t,n))return!1}return!0},Ae=(e,t)=>e.level===t.level&&e.domain.kind===t.domain.kind&&(e.domain.kind!==`Domain`||t.domain.kind===`Domain`&&R(e.domain.expression,t.domain.expression)),je=(e,t)=>{if(e.kind!==t.kind)return!1;switch(e.kind){case`Number`:return t.kind===`Number`&&e.value===t.value;case`Instance`:return t.kind===`Instance`&&L(e.args,t.args,R);case`Label`:return t.kind===`Label`&&e.label===t.label&&L(e.args,t.args,R);default:return!0}},Me=(e,t)=>{if(e.kind===`Operator`&&t.kind===`Operator`||e.kind===`Bpragma`&&t.kind===`Bpragma`)return R(e.body,t.body);if(e.kind===`Instance`&&t.kind===`Instance`){let n=e.instance.substitutions.map(e=>({name:e.name,value:e.expression})),r=t.instance.substitutions.map(e=>({name:e.name,value:e.expression}));return L(e.instance.args,t.instance.args,(e,t)=>e===t)&&e.instance.module===t.instance.module&&ke(n,r)}return!1},Ne=(e,t)=>e.kind===`Fresh`&&t.kind===`Fresh`?e.level!==t.level||e.shape!==t.shape?!1:!e.domain||!t.domain?!e.domain&&!t.domain:R(e.domain,t.domain):e.kind===`Flex`&&t.kind===`Flex`?!0:e.kind===`Defn`&&t.kind===`Defn`?Me(e.definition,t.definition)&&e.isLocal===t.isLocal:e.kind===`Fact`&&t.kind===`Fact`&&R(e.expression,t.expression),Pe=(e,t)=>L(e.context,t.context,Ne)&&R(e.active,t.active),R=(e,t)=>{if(e.kind===`Parens`)return R(e.expression,t);if(t.kind===`Parens`)return R(e,t.expression);switch(e.kind){case`Ix`:return t.kind===`Ix`&&e.index===t.index;case`Opaque`:return t.kind===`Opaque`&&e.name===t.name;case`Internal`:return t.kind===`Internal`&&e.builtin===t.builtin;case`Lambda`:return t.kind===`Lambda`&&e.params.length===t.params.length&&R(e.body,t.body);case`Apply`:return t.kind===`Apply`&&R(e.operator,t.operator)&&L(e.args,t.args,R);case`Sequent`:return t.kind===`Sequent`&&Pe(e.sequent,t.sequent);case`Bang`:return t.kind===`Bang`&&R(e.expression,t.expression)&&L(e.selectors,t.selectors,je);case`With`:return t.kind===`With`&&R(e.expression,t.expression);case`Let`:return t.kind===`Let`&&L(e.definitions,t.definitions,Me)&&R(e.body,t.body);case`If`:return t.kind===`If`&&R(e.condition,t.condition)&&R(e.consequent,t.consequent)&&R(e.alternative,t.alternative);case`List`:return t.kind===`List`&&e.bullet===t.bullet&&L(e.items,t.items,R);case`Quant`:return t.kind===`Quant`&&e.quantifier===t.quantifier&&L(e.bounds,t.bounds,Ae)&&R(e.body,t.body);case`Tquant`:return t.kind===`Tquant`&&e.quantifier===t.quantifier&&L(e.names,t.names,(e,t)=>e===t)&&R(e.body,t.body);case`Choose`:return t.kind===`Choose`?e.domain&&t.domain?R(e.domain,t.domain)&&R(e.body,t.body):!e.domain&&!t.domain&&R(e.body,t.body):!1;case`SetSt`:return t.kind===`SetSt`&&R(e.domain,t.domain)&&R(e.body,t.body);case`SetOf`:return t.kind===`SetOf`&&R(e.element,t.element)&&L(e.bounds,t.bounds,Ae);case`SetEnum`:return t.kind===`SetEnum`&&L(e.elements,t.elements,R);case`Arrow`:return t.kind===`Arrow`&&R(e.domain,t.domain)&&R(e.range,t.range);case`Fcn`:return t.kind===`Fcn`&&L(e.bounds,t.bounds,Ae)&&R(e.body,t.body);case`FcnApp`:return t.kind===`FcnApp`&&L([e.function,...e.args],[t.function,...t.args],R);case`Tuple`:return t.kind===`Tuple`&&L(e.elements,t.elements,R);case`Product`:return t.kind===`Product`&&L(e.factors,t.factors,R);case`Rect`:return t.kind===`Rect`&&ke(e.fields,t.fields);case`Record`:return t.kind===`Record`&&ke(e.fields,t.fields);case`Except`:return t.kind===`Except`&&R(e.function,t.function)&&L(e.specs,t.specs,(e,t)=>L(e.trail,t.trail,(e,t)=>e.kind===`Dot`?t.kind===`Dot`&&e.field===t.field:t.kind===`Apply`&&R(e.expression,t.expression))&&R(e.value,t.value));case`Dot`:return t.kind===`Dot`&&R(e.expression,t.expression)&&e.field===t.field;case`Sub`:case`Tsub`:return t.kind===e.kind&&e.modal===t.modal&&R(e.action,t.action)&&R(e.subscript,t.subscript);case`Fair`:return t.kind===`Fair`&&e.fairness===t.fairness&&R(e.subscript,t.subscript)&&R(e.action,t.action);case`Case`:return t.kind!==`Case`||!(e.arms.length===0||t.arms.length===0?e.arms.length===t.arms.length:R(e.arms[0].condition,t.arms[0].condition)&&R(e.arms[0].body,t.arms[0].body))?!1:e.other&&t.other?R(e.other,t.other):!e.other&&!t.other;case`String`:return t.kind===`String`&&e.value===t.value;case`Num`:return t.kind===`Num`&&e.integer===t.integer&&e.fraction===t.fraction;case`At`:return t.kind===`At`&&e.isExcept===t.isExcept}},Fe=(e,t)=>e.map(e=>e.domain.kind===`Domain`?{...e,domain:{kind:`Domain`,expression:t(e.domain.expression)}}:e),Ie=(e,t)=>e.kind===`Instance`||e.kind===`Label`?{...e,args:e.args.map(t)}:e,Le=(e,t)=>e.map(e=>{let n=t(e.value);return{trail:e.trail.map(e=>e.kind===`Apply`?{kind:`Apply`,expression:t(e.expression)}:e),value:n}}),Re=(e,t)=>e.kind===`Operator`||e.kind===`Bpragma`?{...e,body:t(e.body)}:e,ze=(e,t,n)=>e.kind===`Fresh`?e.domain?{...e,domain:t(e.domain)}:e:e.kind===`Flex`||n===`visible`&&e.visibility===`Hidden`?e:e.kind===`Defn`?{...e,definition:Re(e.definition,t)}:{...e,expression:t(e.expression)},Be=(e,t,n,r,i=`visible`)=>{let a=t=>n(e,t),o=t=>t.reduce((e,t)=>r(e,P(t.name,t.level)),e);switch(t.kind){case`Ix`:case`Internal`:case`Opaque`:case`String`:case`Num`:case`At`:return t;case`Lambda`:{let i=t.params.reduce((e,t)=>{let n=P(t.name,`Unknown`,t.shape);return r(e,t.location?{...n,location:t.location}:n)},e);return{...t,body:n(i,t.body)}}case`Sequent`:{let[a,o]=N(e,t.sequent.context,(e,t)=>{let a=ze(t,t=>n(e,t),i);return[r(e,a),a]});return{...t,sequent:{context:o,active:n(a,t.sequent.active)}}}case`Let`:{let[i,a]=N(e,t.definitions,(e,t)=>{let i=Re(t,t=>n(e,t));return[r(e,{kind:`Defn`,definition:i,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),i]});return{...t,definitions:a,body:n(i,t.body)}}case`Quant`:case`Fcn`:{let e=Fe(t.bounds,a);return{...t,bounds:e,body:n(o(e),t.body)}}case`SetOf`:{let e=Fe(t.bounds,a);return{...t,bounds:e,element:n(o(e),t.element)}}case`Tquant`:{let i=t.names.reduce((e,t)=>r(e,{kind:`Flex`,name:t}),e);return{...t,body:n(i,t.body)}}case`Choose`:{let i=t.domain&&a(t.domain),o=i?be(t.name,i):P(t.name,`Constant`);return{...t,domain:i,body:n(r(e,o),t.body)}}case`SetSt`:{let i=a(t.domain),o=be(t.name,i);return{...t,domain:i,body:n(r(e,o),t.body)}}case`Bang`:{let e=t.selectors.map(e=>Ie(e,a));return{...t,expression:a(t.expression),selectors:e}}case`Apply`:{let e=t.args.map(a);return{...t,operator:a(t.operator),args:e}}case`With`:case`Dot`:case`Parens`:return{...t,expression:a(t.expression)};case`If`:{let e=a(t.alternative),n=a(t.consequent);return{...t,condition:a(t.condition),consequent:n,alternative:e}}case`List`:return{...t,items:t.items.map(a)};case`SetEnum`:case`Tuple`:return{...t,elements:t.elements.map(a)};case`Product`:return{...t,factors:t.factors.map(a)};case`FcnApp`:{let e=t.args.map(a);return{...t,function:a(t.function),args:e}}case`Arrow`:{let e=a(t.range);return{...t,domain:a(t.domain),range:e}}case`Rect`:case`Record`:return{...t,fields:t.fields.map(e=>({name:e.name,value:a(e.value)}))};case`Except`:{let e=Le(t.specs,a);return{...t,function:a(t.function),specs:e}}case`Sub`:case`Tsub`:case`Fair`:return{...t,subscript:a(t.subscript),action:a(t.action)};case`Case`:{let e=t.other&&a(t.other),n=t.arms.map(e=>{let t=a(e.body);return{condition:a(e.condition),body:t}});return{...t,arms:n,other:e}}}},Ve=(e,t)=>Be(void 0,e,(e,n)=>t(n),()=>void 0,`all`),He=e=>{let t=[];return Ve(e,e=>(t.push(e),e)),t},Ue={kind:`Opaque`,name:`$Bad`},We=e=>e.kind===`Opaque`&&e.name===Ue.name,Ge=e=>{let t=e.kind===`Parens`?Ge(e.expression):Ve(e,Ge);if(!t.isAtomic)return t;let{isAtomic:n,...r}=t;return r},Ke=e=>e.kind===`Let`?A({kind:`Let`,definitions:e.definitions,body:Ke(e.body)},e.body):e.kind===`Parens`?Ke(e.expression):Ve(e,Ke),qe=e=>e.kind===`Ix`?e.index<=0:He(e).some(qe),Je=(e,t,n)=>{let r=(e,r=n)=>Je(e,t,r),i=(e,t)=>e.reduce((e,t)=>e??(t.domain.kind===`Domain`?r(t.domain.expression):void 0),void 0)??r(t,[...n,...e.map(e=>P(e.name,e.level))]);switch(e.kind){case`Parens`:return e.form.kind===`Xlabel`?e.form.label===t?{context:n,expression:e.expression,indices:e.form.indices}:void 0:r(e.expression);case`Lambda`:return r(e.body,[...n,...e.params.map(e=>P(e.name,`Unknown`,e.shape))]);case`Let`:{let t=[...n];for(let n of e.definitions){let e=n.kind===`Operator`||n.kind===`Bpragma`?r(n.body,[...t]):void 0;if(e)return e;t.push({kind:`Defn`,definition:n,whereDefined:`Builtin`,visibility:`Visible`,isLocal:!0})}return r(e.body,t)}case`Quant`:case`Fcn`:return i(e.bounds,e.body);case`SetOf`:return i(e.bounds,e.element);case`Tquant`:return r(e.body,[...n,...e.names.map(e=>({kind:`Flex`,name:e}))]);case`Choose`:case`SetSt`:return(e.domain&&r(e.domain))??r(e.body,[...n,P(e.name,`Constant`)]);case`Sequent`:{let t=[...n];for(let n of e.sequent.context){if(n.kind!==`Fact`)return;let e=r(n.expression,[...t]);if(e)return e;t.push(n)}return r(e.sequent.active,t)}default:for(let t of He(e)){let e=r(t);if(e)return e}return}},Ye=(e,t)=>pe(Array.from({length:e},(e,t)=>({kind:`Ix`,index:t+1})),O(e+t)),Xe=e=>Array.from({length:e},(t,n)=>({kind:`Ix`,index:e-n})),Ze=(e,t,n)=>{switch(t.kind){case`Quant`:case`Fcn`:case`SetOf`:{if(t.bounds.length!==n.length){let r=t.bounds.length,i=`Arity mismatch in subexpression instance.\nExpected ${r} argument${r===1?``:`s`}, but found${n.length<r?` only`:``} ${n.length}.`;throw e(D(t.location,i)),new s(i,{failure:`Expr.Deref.deref_inst`})}let r=t.kind===`SetOf`?t.element:t.body;return F(pe(n,O(0)),r)}case`Tquant`:return Ze(e,A({kind:`Quant`,quantifier:t.quantifier,bounds:t.names.map(e=>({name:e,level:`State`,domain:{kind:`NoDomain`}})),body:t.body},t),n);case`Lambda`:return Ze(e,A({kind:`Quant`,quantifier:`Forall`,bounds:t.params.map(e=>({name:e.name,level:`Unknown`,domain:{kind:`NoDomain`}})),body:t.body},t),n);case`SetSt`:case`Choose`:if(n.length!==1){let r=`Arity mismatch in subexpression instance.\nExpected 1 argument, but found ${n.length}.`;throw e(D(t.location,r)),new s(r,{failure:`Expr.Deref.deref_inst`})}return F(pe(n,O(0)),t.body);default:{let n=`Cannot instantiate non-binding expression`;throw e(D(t.location,n)),new s(n,{failure:`Expr.Deref.deref_inst`})}}},Qe=(e,t,n)=>{let r=(()=>{switch(n.kind){case`Quant`:case`Fcn`:case`SetOf`:return n.bounds.map(e=>({name:e.name,shape:0}));case`Tquant`:return n.names.map(e=>({name:e,shape:0}));case`Lambda`:return n.params;case`SetSt`:case`Choose`:return[{name:n.name,shape:0}];default:{let t=`Cannot abstract over bound variables in a non-binding expression`;throw e(D(n.location,t)),new s(t,{failure:`Expr.Deref.deref_at`})}}})(),i=F(Ye(t,r.length),n);return[r,Ze(e,i,Xe(r.length))]},$e=(e,t,n,r,i,a)=>{let o=t=>{if(!(r<=t))throw e(D(i.location,a)),new s(a,{failure:`Expr.Deref.deref_num`})},c=e=>(o(e.length),e[r-1]),l=(()=>{switch(n.kind){case`Sequent`:{let i=n.sequent;o(i.context.length+1);let a=i.context[r-1];if(a&&a.kind!==`Fact`){let t=`subexpression reference does not resolve to an expression`;throw e(D(n.location,t)),new s(t,{failure:`Expr.Deref.deref_num`})}let c=F(O(-(r-1)),a?a.expression:i.active);if(qe(c))throw e(D(n.location,`subexpression of ASSUME/PROVE uses identifiers declared therein
+Tlapm does not handle yet such subexpression namings.`)),new s(`Subexpression of ASSUME/PROVE uses identifiers declared therein
+
+Tlapm does not handle yet such subexpression namings.`,{failure:`Expr.Deref.deref_num`});return[t,c]}case`Apply`:return[t,c(n.args)];case`With`:return $e(e,t,n.expression,r,i,a);case`If`:return[t,c([n.condition,n.consequent,n.alternative])];case`List`:return[t,c(n.items)];case`SetEnum`:case`Tuple`:return[t,c(n.elements)];case`Product`:return[t,c(n.factors)];case`Let`:return o(1),[[...t,...n.definitions],n.body];case`Quant`:case`SetOf`:case`Fcn`:return[t,c(n.bounds.flatMap(e=>e.domain.kind===`Domain`?[e.domain.expression]:[]))];case`Choose`:case`SetSt`:if(!n.domain)break;return[t,c([n.domain])];case`Arrow`:return[t,c([n.domain,n.range])];case`FcnApp`:{let e=n.args.length===1?n.args[0]:A({kind:`Tuple`,elements:n.args},n);return[t,c([n.function,e])]}case`Rect`:case`Record`:return[t,c(n.fields.map(e=>e.value))];case`Dot`:return[t,c([n.expression,A({kind:`String`,value:n.field},n)])];case`Except`:return[t,c([n.function,...n.specs.map(e=>e.value)])];case`Sub`:case`Tsub`:return[t,c([n.action,n.subscript])];case`Fair`:return[t,c([n.subscript,n.action])];case`Case`:return[t,c([...n.arms.map(e=>A({kind:`Tuple`,elements:[e.condition,e.body]},e.body)),...n.other?[A({kind:`Tuple`,elements:[Ue,n.other]},n.other)]:[]])]}let l=`Expression has no subexpressions`;throw e(D(n.location,l)),new s(l,{failure:`Expr.Deref.deref_num`})})();if(We(l[1])){let t=`Cannot resolve subexpression reference !${r}`;throw e(D(n.location,t)),new s(t,{failure:`Expr.Deref.deref_num`})}return l},et=(e,t)=>{let n=e.length,r=e;for(let e=n-1;e>=0;e--)r.includes(n-e)||(r=r.map(t=>t+e<n?t:t-1));return r.map(e=>t[n-e])},tt=(e,t,n,r,a)=>{let o=Je(n,r,[]);if(!o)return e(D(n.location,`Could not find label ${r}`)),{params:[],definitions:[],expression:Ue};let c=o.indices;if(c.length!==a.length&&a.length>0){let t=c.length===1?``:`s`,n=`Expected ${c.length} argument${t} for labelled reference !${r}, but found ${a.length}`;throw e(D(o.expression.location,n)),new s(n,{failure:`Expr.Deref.deref_lsub`})}let l=a.length===0?c.map(e=>({name:e.name,shape:0})):[],u=a.length===0?Xe(c.length):a,d=o.context.reduceRight((e,t)=>t.kind===`Defn`?A({kind:`Let`,definitions:[t.definition],body:e},e):t.kind===`Fresh`?A({kind:`Quant`,quantifier:`Forall`,bounds:[{name:t.name,level:`Constant`,domain:{kind:`NoDomain`}}],body:e},e):F(O(-1),e),o.expression),f=F(Ye(t,l.length),d),p=[],m=f,h=et(c.map(e=>e.index),u);for(;h.length>0;)if(m.kind===`Let`&&m.definitions.length===1)p.push(m.definitions[0]),m=m.body,h=h.map(e=>F(O(1),e));else{if(m.kind!==`Quant`||m.bounds.length!==1)throw new i(`File "src/expr/e_deref.ml", line 477, characters 21-33: Assertion failed`);m=F(fe(h[0],O(0)),m.body),h=h.slice(1)}return{params:l,definitions:p,expression:m}},nt=(e,t,n,r,i)=>{if(n.kind!==`Let`)throw e(D(n.location,`not a LET expression`)),new s(`not a LET expression`,{failure:`Expr.Deref.deref_letop`});let a=n.definitions.findIndex(e=>e.kind===`Operator`&&e.name===r),o=n.definitions[a];if(!o||o.kind!==`Operator`){let t=`no definition of operator ${r}`;throw e(D(n.location,t)),new s(t,{failure:`Expr.Deref.deref_letop`})}let c=o.body,l=c.kind===`Lambda`?A({...c,body:A({kind:`Parens`,expression:c.body,form:{kind:`Xlabel`,label:r,indices:c.params.map((e,t)=>({name:e.name,index:c.params.length-t}))}},c.body)},c):A({kind:`Parens`,expression:c,form:{kind:`Xlabel`,label:r,indices:[]}},c);return tt(e,t,A({kind:`Let`,definitions:n.definitions.slice(0,a),body:l},c),r,i)},rt=(e,t,n,r)=>{let[i,...a]=r;if(!i){let e=n.definitions.length===0?n.expression:A({kind:`Let`,definitions:n.definitions,body:n.expression},n.expression),t=n.params.length===0?e:A({kind:`Lambda`,params:n.params,body:e},e);return{...Ge(t),isAtomic:!0}}if(n.expression.isAtomic)return e(D(n.expression.location,`Expression has no subexpressions`)),Ue;let o=t?n.expression:Ke(n.expression),c=n.definitions.length,l=(()=>{let r=(t,r)=>{let[i,s]=$e(e,[],o,t,n.expression,r);return{params:[],definitions:i,expression:s,rest:a,isLabel:!1}};switch(i.kind){case`Down`:{let[n,...r]=a;if(o.kind===`Let`&&n?.kind===`Label`&&t)return{...nt(e,c,o,n.label,n.args),rest:r,isLabel:!0};if(t)return{params:[],definitions:[],expression:o,rest:a,isLabel:!1};throw new s(`!: is forbidden for this expression.
+`,{failure:`Expr.Deref.deref: !:`})}case`Number`:return r(i.value,`Cannot resolve !${i.value}`);case`Left`:return r(1,`Cannot resolve !<<`);case`Right`:return r(2,`Cannot resolve !>>`);case`Instance`:return{params:[],definitions:[],expression:Ze(e,o,i.args),rest:a,isLabel:!1};case`Label`:return{...o.kind===`Let`&&!t?nt(e,c,o,i.label,i.args):tt(e,c,o,i.label,i.args),rest:a,isLabel:!0};case`At`:{let[t,n]=Qe(e,c,o);return{params:t,definitions:[],expression:n,rest:a,isLabel:!1}}}})();return rt(e,l.isLabel,{params:[...n.params,...l.params],definitions:[...n.definitions,...l.definitions],expression:l.expression},l.rest.map(e=>Ie(e,e=>F(O(l.definitions.length),e))))},it=(e,t,n)=>{if(n.length>0)return{params:[],definitions:[],expression:Ze(e,t,n)};if(t.kind!==`Lambda`)return{params:[],definitions:[],expression:t};let[r,i]=Qe(e,0,t);return{params:r,definitions:[],expression:i}},at=(e,t,n,r)=>{let i=rt(e,!0,it(e,t,n),r);if(We(i)){let n=`Could not resolve subexpression reference`;throw e(D(t.location,n)),new s(n,{failure:`Expr.Anon: 2`})}return i},ot=e=>e.kind===`Named`?`<${e.level}>${e.label}`:`<${e.level}>`,st=e=>++e.value,ct={kind:`Fact`,expression:{kind:`At`,isExcept:!1},visibility:`Visible`},lt={Number:`1NUM`,Down:`1DOWN`,At:`1AT`,Instance:`1INST`,Left:`1`,Right:`1`},ut={kind:`Opaque`,name:`$badexp`},dt=(e,t,n)=>{let r,a=e=>e.scope?.size??0,o=(e,t)=>{if(t.kind===`At`&&t.isExcept)return r?I(a(e)-r.size,r.expression):t;if(t.kind!==`Except`)return f(e,t);let n=o(e,t.function);return t.specs.reduce((n,i)=>{let[s,c]=N(n,i.trail,(t,n)=>{if(n.kind===`Dot`)return[A({kind:`Dot`,expression:t,field:n.field},t),n];let r=o(e,n.expression);return[A({kind:`FcnApp`,function:t,args:[r]},t),{kind:`Apply`,expression:r}]}),l=r;r={expression:s,size:a(e)};let u=o(e,i.value);return r=l,A({kind:`Except`,function:n,specs:[{trail:c,value:u}]},t)},n)},c=(e,t,n)=>{let r=A({kind:`Ix`,index:e},n);return t.length===0?r:A({kind:`Apply`,operator:r,args:t},n)},l=(e,t,n,r,i)=>{if(t!==`Builtin`)return c(e,r,i);let a=I(e,n);return A(r.length===0?a:Ce(a,r),i)},u=(e,t,r,a)=>{let o=ve(e.scope,t);if(!o){let e=`Operator "${t}" not found`;throw n(D(a.location,e)),new s(e,{failure:`Expr.Anon: 4`})}let u=o.depth+1,d=o.hyp;switch(d.kind){case`Defn`:{let e=d.definition;if(e.kind===`Operator`)return l(u,d.whereDefined,e.body,r,a);if(e.kind===`Recursive`)throw new s(`Recursive operators not supported by TLAPS`,{failure:`Expr.Anon: Recursive`});return c(u,r,a)}case`Fresh`:return c(u,r,a);case`Flex`:return A({kind:`Ix`,index:u},a);case`Fact`:throw new i(`File "src/expr/e_anon.ml", line 230, characters 24-36: Assertion failed`)}},d=(e,t,r,i,a,c)=>{let u=ve(e.scope,t);if(!u){let[a,...l]=i;if(a?.kind===`Label`){let n=a.args.map(t=>o(e,t));return d(e,`${t}!${a.label}`,[...r,...n],l,!0,c)}let u=`Operator "${t}" not found`;throw a&&n(D(c.location,u)),new s(u,{failure:`Expr.Anon: ${a?lt[a.kind]:`1EMPTY`}`})}let f=u.hyp;if(f.kind!==`Defn`||f.definition.kind!==`Operator`&&f.definition.kind!==`Bpragma`)throw new s(`invalid subexpression reference`);let p=u.depth+1;if(i.length===0&&a)return r.length===0?A({kind:`Ix`,index:p},c):l(p,f.whereDefined,f.definition.body,r,c);let m=ft(I(p,f.definition.body),c);return ft(at(n,m,r,i),c)},f=(e,t)=>{switch(t.kind){case`Bang`:{let n=t.expression;if(n.kind===`Apply`&&n.operator.kind===`Opaque`){let r=t.selectors.map(t=>Ie(t,t=>o(e,t))),i=n.args.map(t=>o(e,t)),a={warnedSteps:[],scope:e.scope};return d(a,n.operator.name,i,r,!1,t)}return o(e,{...t,expression:A({kind:`Apply`,operator:n,args:[]},n)})}case`Apply`:{if(t.operator.kind!==`Opaque`)return _(e,t);let r=t.operator.name;if(e.warnedSteps.includes(r))return n({text:`${de(t.location)}Warning: ${r} does not introduce any assumptions. It does not make sense to use it here.\n`,channel:`toolbox`}),A({kind:`Internal`,builtin:`TRUE`},t);let i=t.args.map(t=>o(e,t));return u(e,r,i,t)}case`Opaque`:return o(e,A({kind:`Apply`,operator:t,args:[]},t));case`Parens`:return t.form.kind===`Syntax`?o(e,t.expression):{...t,expression:o(e,t.expression),form:p(e,t.form)};default:return _(e,t)}},p=(e,t)=>t.kind===`Nlabel`?{kind:`Xlabel`,label:t.label,indices:t.names.map(t=>{let n=ve(e.scope,t);if(!n)throw new s(`Identifier "${t}" in label parameters not found`);return{name:t,index:n.depth+1}})}:t,m=(e,t)=>({warnedSteps:e.warnedSteps,scope:t}),h=(e,t)=>m(e,M(e.scope,t)),g=(e,t)=>{let n=Fe(t,t=>o(e,t));return[n.reduce((e,t)=>h(e,P(t.name,t.level)),e),n]},_=(e,t)=>{if(t.kind===`Sequent`)return{...t,sequent:b(e,t.sequent)[1]};if(t.kind===`Let`){let[n,r]=y(e,t.definitions);return{...t,definitions:r,body:o(n,t.body)}}return Be(e,t,o,h)},v=(e,t)=>{if(t.kind!==`Operator`)return t;let n=t.body;if(n.kind!==`Fcn`)return{...t,body:o(e,n)};let r=o(h(e,P(t.name,`Constant`)),n);if(R(F(fe({kind:`Opaque`,name:`%%%`},O(1)),r),r))return{...t,body:I(-1,r)};let i=j(`Eq`,[A({kind:`Ix`,index:1},r),r],r);return{...t,body:A({kind:`Choose`,name:t.name,domain:void 0,body:i},r)}},y=(e,n)=>{let r=e,i=[...n],a=[];for(let e=0;e<i.length;e++){let n=i[e];if(n.kind===`Instance`){i.splice(e+1,0,...t(r.scope,n));continue}let o=v(r,n);r=h(r,{kind:`Defn`,definition:o,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),a.push(o)}return[r,a]},ee=(e,t)=>{let n=(()=>{switch(t.kind){case`Fresh`:return t.domain?{...t,domain:o(e,t.domain)}:t;case`Flex`:return t;case`Defn`:return{...t,definition:v(e,t.definition)};case`Fact`:return{...t,expression:o(e,t.expression)}}})();return[h(e,n),n]},b=(e,t)=>{let[n,r]=N(e,t.context,ee);return[n,{context:r,active:o(n,t.active)}]},x=(e,t)=>({warnedSteps:[ot(t),...e.warnedSteps],scope:e.scope}),S=(e,t,n,r)=>h(e,{kind:`Defn`,definition:{kind:`Operator`,name:ot(t),body:n,location:r.location},whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:r.location}),C=(e,t)=>m(e,ge(e.scope,Array.from({length:t},()=>ct))),te=e=>{let t=[...e.context.map((t,n)=>{let r=e.context.length-n+1;if(t.kind===`Fact`)return I(r,t.expression);if(t.kind!==`Fresh`||!t.domain)return ut;let i=j(`Mem`,[A({kind:`Ix`,index:0},t.domain),t.domain],t.domain);return I(r,i)}),I(1,e.active)];return t.length===1?t[0]:{kind:`Tuple`,elements:t}},ne=e=>e.kind!==`Use`&&e.kind!==`Hide`&&e.kind!==`Define`,w=(e,t)=>({facts:t.facts.map(t=>o(e,t)),defs:t.defs.flatMap(t=>{if(t.kind===`Dx`)return[t];let r=o(e,A({kind:`Opaque`,name:t.name},t));return r.kind===`Ix`?ye(e.scope,r.index-1)?.hyp.kind===`Defn`?[{kind:`Dx`,index:r.index,location:t.location}]:(n({text:`${de(t.location)}${JSON.stringify(t.name)} is not a definition and cannot be used in a DEF clause.`,channel:`toolbox`}),[]):(n({text:`${de(t.location)}Ignored unexpandable identifier ${JSON.stringify(t.name)} in BY DEF.`,channel:`stderr`}),[])})}),T=(e,t)=>{switch(t.kind){case`Steps`:{let[n,r]=N(e,t.steps,E),i=T(t.step?x(n,t.step):n,t.qed.proof);return{...t,steps:r,qed:{...t.qed,proof:i}}}case`By`:return{...t,usable:w(e,t.usable)};default:return t}},E=(t,n)=>{let r=n.step?.kind===`Unnamed`&&ne(n)?{kind:`Named`,level:n.step.level,label:`_a${st(e)}`,isAnonymous:!0}:n.step;if(!r)throw new i;let a={...n,step:r};switch(a.kind){case`Assert`:{let[,e]=b(t,a.sequent),n=e.context.reduce(h,t),i=C(S(C(n,1),r,A(te(e),a),a),1),o=e.context.length===0?x(i,r):i,s={...a,sequent:e,proof:T(o,a.proof)};return[C(S(t,r,A(he(e),a),a),1),s]}case`Pcase`:{let e=o(t,a.expression),n=A({kind:`Tuple`,elements:[I(2,e)]},a),i=C(S(C(t,2),r,n,a),1),s={...a,expression:e,proof:T(i,a.proof)},c=S(t,r,A({kind:`Tuple`,elements:[e]},a),a);return[C(c,1),s]}case`Suffices`:{let[,e]=b(t,a.sequent),n=A({kind:`Tuple`,elements:[A(he(e),a)]},a),i=C(S(t,r,n,a),1),o={...a,sequent:e,proof:T(i,a.proof)},s=e.context.reduce(h,t),c=A({kind:`Tuple`,elements:[A(te(e),a)]},a);return[C(S(C(s,1),r,c,a),1),o]}case`Have`:{let e=o(t,a.expression),n=A({kind:`Tuple`,elements:[I(2,e)]},a);return[C(S(C(t,2),r,n,a),1),{...a,expression:e}]}case`Take`:{let[e,n]=g(t,a.bounds),i=A({kind:`Quant`,quantifier:`Forall`,bounds:n,body:ut},a);return[C(S(C(e,1),r,i,a),1),{...a,bounds:n}]}case`Witness`:{let e=a.expressions.map(e=>o(t,e)),n=A({kind:`Tuple`,elements:e},a);return[C(S(C(t,1),r,n,a),1),{...a,expressions:e}]}case`Pick`:{let[e,n]=g(t,a.bounds),i=o(e,a.expression),s=A({kind:`Quant`,quantifier:`Exists`,bounds:n,body:i},a),c=x(C(S(C(t,1),r,s,a),1),r),l={...a,bounds:n,expression:i,proof:T(c,a.proof)},u=n.reduce((e,t)=>h(e,P(t.name,t.level)),C(t,2)),d=I(4+n.length,s);return[C(S(C(u,2),r,d,a),1),l]}case`Use`:{let e=w(t,a.usable);return[C(t,e.facts.length),{...a,usable:e}]}case`Hide`:return[t,{...a,usable:w(t,a.usable)}];case`Define`:{let[e,n]=y(t,a.definitions);return[e,{...a,definitions:n}]}case`Forget`:return[t,a]}};return{expr:(e,t)=>o({warnedSteps:[],scope:e},t),defn:(e,t)=>v({warnedSteps:[],scope:e},t),sequent:(e,t)=>b({warnedSteps:[],scope:e},t)[1],usable:(e,t)=>w({warnedSteps:[],scope:e},t),proof:(e,t)=>T({warnedSteps:[],scope:e},t)}},ft=(e,t)=>t.location?{...e,location:t.location}:e,pt=1000000010,mt=new TextEncoder,ht=e=>{for(let t=0;t<e.length;t++)if(e.charCodeAt(t)>127)return mt.encode(e).length;return e.length},gt=()=>({leftTotal:-1,element:{size:-1,token:{kind:`Text`,text:``},length:0}}),_t=()=>{let e={size:-1,token:{kind:`Begin`,indent:0,box:`hov`},length:0};return{queue:[e],queueStart:0,scanStack:[gt(),{leftTotal:1,element:e}],formatStack:[],margin:78,maxIndent:68,spaceLeft:78,currentIndent:0,isNewLine:!0,leftTotal:1,rightTotal:1,depth:1,output:[]}},vt=(e,t)=>{e.rightTotal+=t.length,e.queue.push(t)},yt=(e,t,n)=>{e.output.push(`
+`),e.isNewLine=!0,e.currentIndent=Math.min(e.maxIndent,e.margin-n+t),e.spaceLeft=e.margin-e.currentIndent,e.output.push(` `.repeat(e.currentIndent))},bt=(e,t)=>{e.spaceLeft-=t,e.output.push(` `.repeat(t))},xt=e=>{let t=e.formatStack.at(-1);t?t.width>e.spaceLeft&&t.box!==`fits`&&t.box!==`h`&&yt(e,0,t.width):e.output.push(`
+`)},St=(e,t,n)=>{switch(n.kind){case`Text`:e.spaceLeft-=t,e.output.push(n.text),e.isNewLine=!1;return;case`Begin`:{e.margin-e.spaceLeft>e.maxIndent&&xt(e);let r=e.spaceLeft-n.indent,i=n.box===`v`||t>e.spaceLeft?n.box:`fits`;e.formatStack.push({box:i,width:r});return}case`End`:e.formatStack.pop();return;case`Newline`:{let t=e.formatStack.at(-1);t?yt(e,0,t.width):e.output.push(`
+`);return}case`Break`:{let r=e.formatStack.at(-1);if(!r)return;let i=r.width;switch(r.box){case`hov`:t>e.spaceLeft?yt(e,n.offset,i):bt(e,n.width);return;case`b`:e.isNewLine?bt(e,n.width):t>e.spaceLeft||e.currentIndent>e.margin-i+n.offset?yt(e,n.offset,i):bt(e,n.width);return;case`hv`:case`v`:yt(e,n.offset,i);return;case`fits`:case`h`:bt(e,n.width);return}}}},Ct=e=>{for(;e.queueStart<e.queue.length;){let t=e.queue[e.queueStart],n=t.size>=0;if(!n&&e.rightTotal-e.leftTotal<e.spaceLeft)return;e.queueStart++,St(e,n?t.size:pt,t.token),e.leftTotal+=t.length}e.queue.length=0,e.queueStart=0},wt=(e,t)=>{vt(e,t),Ct(e)},Tt=(e,t)=>{let n=e.scanStack.at(-1);n&&(n.leftTotal<e.leftTotal?e.scanStack=[gt()]:n.element.token.kind===(t?`Break`:`Begin`)&&(n.element.size=e.rightTotal+n.element.size,e.scanStack.pop()))},Et=(e,t,n)=>{vt(e,n),t&&Tt(e,!0),e.scanStack.push({leftTotal:e.rightTotal,element:n})},Dt=(e,t,n)=>{e.depth++,Et(e,!1,{size:-e.rightTotal,token:{kind:`Begin`,indent:n,box:t},length:0})},Ot=e=>{e.depth<=1||(vt(e,{size:0,token:{kind:`End`},length:0}),Tt(e,!0),Tt(e,!1),e.depth--)},kt=(e,t,n)=>wt(e,{size:t,token:{kind:`Text`,text:n},length:t}),At=(e,t,n)=>Et(e,!0,{size:-e.rightTotal,token:{kind:`Break`,width:t,offset:n},length:t}),jt=e=>wt(e,{size:0,token:{kind:`Newline`},length:0}),Mt=e=>{for(;e.depth>1;)Ot(e);return e.rightTotal=pt,Ct(e),e.output.join(``)},Nt=e=>{Mt(e);let t=[...e.output,`
+`];Object.assign(e,_t()),e.output=t},Pt={h:`h`,v:`v`,hv:`hv`,hov:`hov`,b:`b`},Ft=e=>({kind:`Text`,text:e,size:ht(e)}),z=e=>e===``?[]:[Ft(e)],It={kind:`Break`,width:1,offset:0},Lt={kind:`Break`,width:0,offset:0},Rt=e=>{let t=e.search(/\d|$/);return{kind:`Open`,box:Pt[e.slice(0,t)],indent:Number(e.slice(t)||0)}},B=(e,...t)=>{let n=[],r=0,i=``,a=()=>{i!==``&&(n.push(Ft(i)),i=``)};for(let o=0;o<e.length;o++){let s=e[o];if(s===`%`){a();let e=t[r++];typeof e==`string`?e!==``&&n.push(Ft(e)):n.push(e),o++}else if(s!==`@`)i+=s;else switch(a(),e[o+1]){case`[`:{if(e[o+2]!==`<`){n.push({kind:`Open`,box:`b`,indent:0}),o++;break}let t=e.indexOf(`>`,o);n.push(Rt(e.slice(o+3,t))),o=t;break}case`]`:n.push({kind:`Close`}),o++;break;case` `:n.push(It),o++;break;case`,`:n.push(Lt),o++;break;case`
+`:n.push({kind:`Newline`}),o++;break;case`.`:n.push({kind:`Flush`}),o++;break;case`;`:{let t=e.indexOf(`>`,o),r=e.slice(o+3,t).split(` `);n.push({kind:`Break`,width:Number(r[0]),offset:Number(r[1])}),o=t;break}case`<`:{let i=e.indexOf(`>`,o);n.push({kind:`Text`,text:String(t[r++]),size:Number(e.slice(o+2,i))}),o=i+2;break}}}return a(),n},V=(e,t,n=[Ft(`,`),It])=>e.flatMap((e,r)=>r===0?[t(e)]:[n,t(e)]),zt=(e,t)=>{for(let n of t)if(Array.isArray(n))zt(e,n);else switch(n.kind){case`Open`:Dt(e,n.box,n.indent);break;case`Close`:Ot(e);break;case`Text`:kt(e,n.size,n.text);break;case`Break`:At(e,n.width,n.offset);break;case`Newline`:jt(e);break;case`Flush`:Nt(e)}},Bt=e=>{let t=_t();return zt(t,e),Mt(t)},Vt=[[`=>`,1,1,`InfixNon`,[]],[`<=>`,2,2,`InfixNon`,[`\\equiv`]],[`/\\`,3,3,`InfixLeft`,[`\\land`]],[`\\/`,3,3,`InfixLeft`,[`\\lor`]],[`~`,4,4,`Prefix`,[`\\neg`,`\\lnot`]],[`=`,5,5,`InfixNon`,[]],[`#`,5,5,`InfixNon`,[`/=`]],[`SUBSET`,8,8,`Prefix`,[]],[`UNION`,8,8,`Prefix`,[]],[`DOMAIN`,9,9,`Prefix`,[]],[`\\subseteq`,5,5,`InfixNon`,[]],[`\\in`,5,5,`InfixNon`,[]],[`\\notin`,5,5,`InfixNon`,[]],[`\\`,8,8,`InfixNon`,[]],[`\\cap`,8,8,`InfixLeft`,[`\\intersect`]],[`\\cup`,8,8,`InfixLeft`,[`\\union`]],[`\\X`,10,13,`Prefix`,[`\\times`]],[`'`,15,15,`Postfix`,[]],[`~>`,2,2,`InfixNon`,[`\\leadsto`]],[`ENABLED`,4,15,`Prefix`,[]],[`UNCHANGED`,4,15,`Prefix`,[]],[`\\cdot`,5,14,`InfixLeft`,[]],[`-+->`,2,2,`InfixNon`,[]],[`[]`,4,15,`Prefix`,[]],[`<>`,4,15,`Prefix`,[]],[`^`,14,14,`InfixNon`,[]],[`/`,13,13,`InfixNon`,[]],[`*`,13,13,`InfixLeft`,[]],[`-.`,12,12,`Prefix`,[`-`]],[`-`,11,11,`InfixLeft`,[]],[`+`,10,10,`InfixLeft`,[]],[`^+`,15,15,`Postfix`,[]],[`^*`,15,15,`Postfix`,[]],[`^#`,15,15,`Postfix`,[]],[`<`,5,5,`InfixNon`,[]],[`=<`,5,5,`InfixNon`,[`<=`,`\\leq`]],[`>`,5,5,`InfixNon`,[]],[`>=`,5,5,`InfixNon`,[`\\geq`]],[`...`,9,9,`InfixNon`,[]],[`..`,9,9,`InfixNon`,[]],[`|`,10,11,`InfixLeft`,[]],[`||`,10,11,`InfixLeft`,[]],[`&&`,13,13,`InfixLeft`,[]],[`&`,13,13,`InfixLeft`,[]],[`$$`,9,13,`InfixLeft`,[]],[`$`,9,13,`InfixLeft`,[]],[`??`,9,13,`InfixLeft`,[]],[`%%`,10,11,`InfixLeft`,[]],[`%`,10,11,`InfixLeft`,[`\\mod`]],[`##`,9,13,`InfixLeft`,[]],[`++`,10,10,`InfixLeft`,[]],[`--`,11,11,`InfixLeft`,[]],[`**`,13,13,`InfixLeft`,[]],[`//`,13,13,`InfixNon`,[]],[`^^`,14,14,`InfixNon`,[]],[`@@`,6,6,`InfixLeft`,[]],[`!!`,9,13,`InfixNon`,[]],[`|-`,5,5,`InfixNon`,[]],[`|=`,5,5,`InfixNon`,[]],[`-|`,5,5,`InfixNon`,[]],[`=|`,5,5,`InfixNon`,[]],[`<:`,7,7,`InfixNon`,[]],[`:>`,7,7,`InfixNon`,[]],[`:=`,5,5,`InfixNon`,[]],[`::=`,5,5,`InfixNon`,[]],[`(+)`,10,10,`InfixLeft`,[`\\oplus`]],[`(-)`,11,11,`InfixLeft`,[`\\ominus`]],[`(.)`,13,13,`InfixLeft`,[`\\odot`]],[`(/)`,13,13,`InfixNon`,[`\\oslash`]],[`(\\X)`,13,13,`InfixLeft`,[`\\otimes`]],[`\\uplus`,9,13,`InfixLeft`,[]],[`\\sqcap`,9,13,`InfixLeft`,[]],[`\\sqcup`,9,13,`InfixLeft`,[]],[`\\div`,13,13,`InfixNon`,[]],[`\\wr`,9,14,`InfixNon`,[]],[`\\star`,13,13,`InfixLeft`,[]],[`\\o`,13,13,`InfixLeft`,[`\\circ`]],[`\\bigcirc`,13,13,`InfixLeft`,[]],[`\\bullet`,13,13,`InfixLeft`,[]],[`\\prec`,5,5,`InfixNon`,[]],[`\\succ`,5,5,`InfixNon`,[]],[`\\preceq`,5,5,`InfixNon`,[]],[`\\succeq`,5,5,`InfixNon`,[]],[`\\sim`,5,5,`InfixNon`,[]],[`\\simeq`,5,5,`InfixNon`,[]],[`\\ll`,5,5,`InfixNon`,[]],[`\\gg`,5,5,`InfixNon`,[]],[`\\asymp`,5,5,`InfixNon`,[]],[`\\subset`,5,5,`InfixNon`,[]],[`\\supset`,5,5,`InfixNon`,[]],[`\\supseteq`,5,5,`InfixNon`,[]],[`\\approx`,5,5,`InfixNon`,[]],[`\\cong`,5,5,`InfixNon`,[]],[`\\sqsubset`,5,5,`InfixNon`,[]],[`\\sqsubseteq`,5,5,`InfixNon`,[]],[`\\sqsupset`,5,5,`InfixNon`,[]],[`\\sqsupseteq`,5,5,`InfixNon`,[]],[`\\doteq`,5,5,`InfixNon`,[]],[`\\propto`,5,5,`InfixNon`,[]]],Ht=/* @__PURE__ */ new Map;for(let[e,t,n,r,i]of Vt){let a={name:e,low:t,high:n,fixity:r};for(let t of[e,...i])Ht.set(t,a)}const Ut=e=>({name:e,low:-1,high:-1,fixity:`Nonfix`}),H=e=>Ht.get(e)??Ut(e),Wt={Implies:`=>`,Equiv:`<=>`,Conj:`/\\`,Disj:`\\/`,Neg:`~`,Eq:`=`,Neq:`#`,SUBSET:`SUBSET`,UNION:`UNION`,DOMAIN:`DOMAIN`,Subseteq:`\\subseteq`,Mem:`\\in`,Notmem:`\\notin`,Setminus:`\\`,Cap:`\\cap`,Cup:`\\cup`,Prime:`'`,StrongPrime:`'`,Leadsto:`~>`,ENABLED:`ENABLED`,UNCHANGED:`UNCHANGED`,Cdot:`\\cdot`,Actplus:`-+->`,BoxTrue:`[]`,BoxFalse:`[]`,Diamond:`<>`,Plus:`+`,Minus:`-`,Times:`*`,Ratio:`/`,Quotient:`\\div`,Remainder:`%`,Exp:`^`,Lteq:`=<`,Lt:`<`,Gteq:`>=`,Gt:`>`,Range:`..`,Cat:`\\o`,OneArg:`:>`,Extend:`@@`},Gt=e=>{if(e===`Divides`)return{name:`?|`,low:10,high:11,fixity:`InfixNon`};if(e===`Uminus`)return{...H(`-.`),name:`-`};let t=Wt[e];return t?H(t):Ut(e)},Kt=e=>e.salt===0?e.rep:`${e.rep}_${e.salt}`,qt=()=>({stack:[],idents:/* @__PURE__ */ new Map,defined:/* @__PURE__ */ new Map}),U=(e,t)=>{let n=e.idents.get(t)?.at(-1),r=n?{rep:t,salt:n.salt+1}:{rep:t,salt:0};for(;e.defined.has(Kt(r));)r={rep:t,salt:r.salt+1};e.stack.push(r);let i=e.idents.get(t);i?i.push(r):e.idents.set(t,[r]);let a=Kt(r);return e.defined.set(a,(e.defined.get(a)??0)+1),a},Jt=(e,t)=>{for(let n=0;n<t;n++){let t=e.stack.pop();if(!t)return;e.idents.get(t.rep)?.pop();let n=Kt(t),r=(e.defined.get(n)??1)-1;r===0?e.defined.delete(n):e.defined.set(n,r)}},Yt=(e,t,n)=>{let r=n(t.map(t=>U(e,t)));return Jt(e,t.length),r},Xt=(e,t)=>t.kind===`Atm`||t.kind===`Op`&&e<t.low,Zt=e=>[B(`(`),e,B(`)`)],Qt=(e,t)=>t?W(e):Zt(W(e)),W=e=>{if(e.kind!==`Op`)return e.doc;let t=e.skeleton,n=t=>Xt(e.high,t);switch(t.kind){case`Prefix`:case`Postfix`:{let r=t.operand,i=Qt(r,n(r)||r.kind===`Op`&&r.skeleton.kind===t.kind),a=t.kind===`Prefix`?[e.doc,i]:[i,e.doc];return[B(`@[<h>`),...a,B(`@]`)]}case`Infix`:{let r=t.left,i=t.right,a=n(r)||r.kind===`Op`&&r.name===e.name&&t.assoc===`Left`,o=n(i)||t.assoc===`Right`&&i.kind===`Op`&&i.skeleton.kind===`Infix`&&i.skeleton.assoc===`Right`;return[B(`@[<b0>`),Qt(r,a),e.doc,Qt(i,o),B(`@]`)]}}},G=e=>({kind:`Atm`,doc:e}),K=e=>({kind:`Big`,doc:e}),$t=e=>e.kind===`Lambda`?$t(e.body):e.kind===`Sequent`?$t(e.sequent.active):e.kind===`With`,en=e=>{if(e.kind===`Defn`){let t=e.definition,n=t.kind===`Operator`&&$t(t.body);return e.visibility===`Hidden`||n||e.whereDefined!==`User`}return e.kind===`Fact`?e.visibility===`Hidden`||$t(e.expression):!1},tn=e=>e===0?[]:B(`@[<hov1>(%a)@]`,V(Array.from({length:e},()=>`_`),z)),nn=e=>B(`%s%a`,e.name,tn(e.shape)),rn={Constant:`CONSTANT`,State:`STATE`,Action:`ACTION`,Temporal:`TEMPORAL`,Unknown:`UNKNOWN`},an=(e=[])=>{let t=qt(),n=e=>W(u(e)),r=(e,r)=>Yt(t,e.map(e=>e.name),()=>B(`@[<b2>LAMBDA @[<hv0>%a@] :@ %a@]`,V(e,nn),n(r))),i=(e,r)=>{let i=e.map(e=>e.domain.kind===`Domain`?n(e.domain.expression):void 0);return Yt(t,e.map(e=>e.name),t=>{let n=[];return e.forEach((e,r)=>{r>0&&e.domain.kind===`Ditto`?n.at(-1)?.names.push(t[r]):n.push({names:[t[r]],index:r})}),r(V(n,t=>{let n=V(t.names,z),r=e[t.index].domain;return r.kind===`NoDomain`?n:r.kind===`Ditto`?B(`@[<hov0>%a@ \\in ??????@]`,n):B(`@[<hov0>%a@ \\in %a@]`,n,i[t.index]??[])}))})},a=e=>{switch(e.kind){case`Down`:return B(`:`);case`Left`:return B(`<<`);case`Right`:return B(`>>`);case`At`:return z(`@`);case`Number`:return z(String(e.value));case`Instance`:return B(`@[<b1>(%a)@]`,V(e.args,n));case`Label`:return e.args.length===0?z(e.label):B(`@[<b2>%s@,@[<b1>(%a)@]@]`,e.label,V(e.args,n))}},o=e=>e.length===0?[]:[B(`!`),V(e,a,B(`!`))],c=n=>{if(n<0)return`#$$${Math.abs(n)}`;if(n===0)return`#$0`;if(n<=t.stack.length)return Kt(t.stack[t.stack.length-n]);let r=e[e.length-(n-t.stack.length)];return r?me(r)??`??? FACT ???`:`#$${n}`},l=(e,t)=>{if(e.kind===`Lambda`)return{kind:`Op`,name:` `,doc:B(`@ `),low:20,high:20,skeleton:{kind:`Infix`,assoc:`Left`,left:K(r(e.params,e.body)),right:G(B(`(%a)`,V(t,n)))}};if(e.kind===`Bang`)return t.length===0?u(e):G(B(`@[<b2>%a@[<b1>(%a)@]@]`,n(e),V(t,n)));if(e.kind===`Internal`&&t.length===1){if(e.builtin===`BoxFalse`||e.builtin===`Unprimable`)return u(t[0]);if(e.builtin===`Irregular`)return G(B(`@[<h>@<1>%s%a@<1>%s@]`,`<[`,n(t[0]),`]>`))}let i=(()=>{switch(e.kind){case`Ix`:return H(c(e.index));case`Opaque`:{let t=H(e.name);return{...t,name:`?${t.name}`}}case`Internal`:return Gt(e.builtin);default:throw new s(`Cannot print this operator`)}})(),a=(e,t)=>({kind:`Op`,name:i.name,doc:e,low:i.low,high:i.high,skeleton:t});if(t.length===0)return G(z(i.name));if(i.fixity===`Nonfix`)return G(B(`@[<b2>%s@[<b1>(%a)@]@]`,i.name,V(t,n)));if(i.fixity===`Prefix`&&t.length===1)return a(/[A-Za-z]$/.test(i.name)?B(`%s@ `,i.name):z(i.name),{kind:`Prefix`,operand:u(t[0])});if(i.fixity===`Postfix`&&t.length===1)return a(z(i.name),{kind:`Postfix`,operand:u(t[0])});if(i.fixity.startsWith(`Infix`)&&t.length===2){let e=i.fixity===`InfixLeft`?`Left`:i.fixity===`InfixRight`?`Right`:`Non`;return a(i.name===`..`?z(i.name):B(`@ %s `,i.name),{kind:`Infix`,assoc:e,left:u(t[0]),right:u(t[1])})}throw new s(`Arity mismatch for operator ${i.name}`)},u=e=>{switch(e.kind){case`Ix`:case`Opaque`:case`Internal`:return l(e,[]);case`Lambda`:return K(r(e.params,e.body));case`Bang`:return G([n(e.expression),o(e.selectors)]);case`Apply`:return l(e.operator,e.args);case`Sequent`:return K(p(e.sequent));case`With`:return u(e.expression);case`If`:return K(B(`@[<hv2>@[<b2>IF@ %a@]@ @[<b2>THEN %a@]@ @[<b2>ELSE %a@]@]`,n(e.condition),n(e.consequent),n(e.alternative)));case`List`:{if(e.bullet===`Refs`&&e.items.length===0)return G(B(`TRUE`));if(e.bullet===`Refs`&&e.items.length===1)return u(e.items[0]);let t=e.bullet===`Or`?`\\/`:`/\\`;return K(B(`@[<v0>%a@]`,V(e.items,e=>B(`@[<h>%s %a@]`,t,n(e)),B(`@,`))))}case`Let`:{let r=V(e.definitions,d,B(`@,`)),i=n(e.body);return Jt(t,e.definitions.length),K([B(`@[<hv0>LET @[<v0>`),r,B(`@]@
+IN  %a@]`,i)])}case`Quant`:return i(e.bounds,t=>K(B(`@[<b3>%s @[<b0>%a@] :@ %a@]`,e.quantifier===`Forall`?`\\A`:`\\E`,t,n(e.body))));case`Tquant`:return Yt(t,e.names,t=>K(B(`@[<b4>%s @[<b0>%a@] : %a@]`,e.quantifier===`Forall`?`\\AA`:`\\EE`,V(t,z),n(e.body))));case`Choose`:{let r=e.domain&&n(e.domain);return Yt(t,[e.name],([t])=>K(r?B(`@[<b2>CHOOSE @[<b2>%s \\in@ %a@] :@ %a@]`,t,r,n(e.body)):B(`@[<b2>CHOOSE %s :@ %a@]`,t,n(e.body))))}case`SetSt`:{let r=n(e.domain);return Yt(t,[e.name],([t])=>G(B(`@[<b3>{@[<b2>%s \\in@ %a@] :@ %a}@]`,t,r,n(e.body))))}case`SetOf`:return i(e.bounds,t=>G(B(`@[<b3>{%a :@ %a}@]`,n(e.element),t)));case`SetEnum`:return G(B(`@[<h>{@[<b0>%a@]}@]`,V(e.elements,n)));case`Arrow`:return G(B(`@[<b3>[%a ->@ %a]@]`,n(e.domain),n(e.range)));case`Fcn`:return i(e.bounds,t=>G(B(`@[<b3>[%a |->@ %a]@]`,t,n(e.body))));case`FcnApp`:{let t=u(e.function),r=t.kind===`Atm`;return G(B(`@[<h>%s%a%s@[<b1>[%a]@]@]`,r?``:`(`,W(t),r?``:`)`,V(e.args,n)))}case`Product`:if(e.factors.length===1)return u(e.factors[0]);if(e.factors.length===0)throw new s(`Expr.Fmt.fmt_expr: PRODUCT []`);return{kind:`Op`,name:`\\X`,doc:B(`@ \\X `),low:10,high:13,skeleton:{kind:`Infix`,assoc:`Right`,left:u(e.factors[0]),right:u({...e,factors:e.factors.slice(1)})}};case`Tuple`:return G(B(`@[<b2><<%a>>@]`,V(e.elements,n)));case`Rect`:return G(B(`@[<b1>[%a]@]`,V(e.fields,e=>B(`@[<h>%s : %a@]`,e.name,n(e.value)))));case`Record`:return G(B(`@[<b1>[%a]@]`,V(e.fields,e=>B(`@[<h>%s |-> %a@]`,e.name,n(e.value)))));case`Except`:return G(B(`@[<b3>[%a EXCEPT@ @[<v0>%a@]]@]`,n(e.function),V(e.specs,e=>B(`!@[<h>%a = %a@]`,e.trail.map(e=>e.kind===`Dot`?B(`.%s`,e.field):B(`[%a]`,n(e.expression))),n(e.value)))));case`Dot`:return{kind:`Op`,name:`.`,doc:B(`.`),low:16,high:16,skeleton:{kind:`Infix`,assoc:`Left`,left:u(e.expression),right:G(z(e.field))}};case`Sub`:case`Tsub`:{let t=e.modal===`Box`,r=e.kind===`Sub`?t?`[`:`<<`:t?`[][`:`<><<`;return G(B(`@[<h>%s@[<b2>%a@]%s%a@]`,r,n(e.action),t?`]_`:`>>_`,n(e.subscript)))}case`Fair`:return K(B(`@[<h>%s_%a (%a)@]`,e.fairness===`Weak`?`WF`:`SF`,Zt(n(e.subscript)),n(e.action)));case`Case`:return K(B(`@[<v2>CASE %a%a@]`,V(e.arms,e=>B(`@[<b2>%a ->@ %a@]`,n(e.condition),n(e.body)),B(`@,[] `)),e.other?B(`@,[] @[<b2>OTHER ->@ %a@]`,n(e.other)):[]));case`String`:return G(B(`"%s"`,e.value));case`Num`:return G(z(e.fraction===``?e.integer:`${e.integer}.${e.fraction}`));case`At`:return G(z(`@`));case`Parens`:{let n=e.form;if(n.kind===`Syntax`)return u(e.expression);let r=n.kind===`Nlabel`?n.names:n.indices.map(e=>e.index>=1&&e.index<=t.stack.length?c(e.index):`¶${e.index}`),i=u(e.expression);if(r.length===0){let e=i.kind===`Op`?`%s::(%a)`:`%s::%a`;return G(B(e,n.label,W(i)))}let a=V(r,z);return i.kind===`Atm`?G(B(`%s(%a)::%a`,n.label,a,W(i))):i.kind===`Big`?G(B(`%s(%a)::(%a)`,n.label,a,W(i))):G(B(`(%s(%a):: %a)`,n.label,a,W(i)))}}},d=e=>{switch(e.kind){case`Operator`:case`Bpragma`:{let r=e.body;if(r.kind===`Lambda`){let i=Yt(t,r.params.map(e=>e.name),()=>n(r.body)),a=U(t,e.name);return B(`@[<b2>%s@[<b1>(%a)@] ==@ %a@]`,a,V(r.params,nn),i)}let i=n(r);return B(`@[<b2>%s ==@ %a@]`,U(t,e.name),i)}case`Instance`:{let r=e.instance,i=Yt(t,r.args,e=>({doc:B(`@[<b2>INSTANCE %s%a@]`,r.module,r.substitutions.length===0?[]:B(`@ WITH@ %a`,V(r.substitutions,e=>B(`@[<b2>%s <- %a@]`,e.name,n(e.expression))))),args:e})),a=U(t,e.name),o=r.args.length===0?z(a):B(`%s (@[<b0>%a@])`,a,V(i.args,z));return B(`@[<b2>%a == %a@]`,o,i.doc)}case`Recursive`:{let n=U(t,e.name);return B(`@[<b2>NEW CONSTANT %s%a@]`,n,tn(e.shape))}}},f=e=>{switch(e.kind){case`Fresh`:{let r=e.domain&&e.domainVisibility===`Visible`?n(e.domain):void 0,i=U(t,e.name);return[B(`NEW %s %s%a`,rn[e.level],i,tn(e.shape)),r?B(` \\in %a`,r):[]]}case`Flex`:return B(`NEW VARIABLE %s`,U(t,e.name));case`Defn`:return d(e.definition);case`Fact`:{let r=B(`@[<h>%a @]`,n(e.expression));return U(t,``),r}}},p=e=>{if(e.context.length===0)return n(e.active);let r=[];for(let n of e.context)en(n)?U(t,me(n)??``):r.push(f(n));let i=n(e.active);return Jt(t,e.context.length),r.length===0?i:[B(`@[<v0>ASSUME @[<v0>`),V(r,e=>e),B(`@]@
+PROVE  %a@]`,i)]};return{printSequent:p,printExpr:n}},on=(e,t)=>an(e).printExpr(t),sn=e=>{let t=an();return Bt(B(`@[<b0>%a@]`,t.printSequent(e))).trimEnd()},cn={kind:`At`,isExcept:!1},q=e=>({location:e.location,step:e.step,isSuppressed:e.isSuppressed}),ln=e=>e?.kind===`Named`&&e.isAnonymous,un=e=>e?.level??0,dn=e=>A({kind:`Internal`,builtin:`TRUE`},e),fn=(e,t)=>e.kind===`Apply`&&e.operator.kind===`Internal`&&e.operator.builtin===t&&e.args.length===2,pn=(e,...t)=>Bt(B(e,...t)),mn=e=>hn(e).map((e,t)=>{let n=e.domain.kind===`Domain`?I(t,e.domain.expression):void 0;return{kind:`Fresh`,name:e.name,shape:0,level:n?`Constant`:e.level,domain:n,domainVisibility:`Visible`}}),hn=e=>{let t={kind:`NoDomain`};return e.map(e=>e.domain.kind===`Ditto`?{...e,domain:t}:(t=e.domain,e))},gn=(e,t)=>t.context.flatMap((n,r)=>n.kind===`Fact`&&n.visibility===`Visible`?[I(e+t.context.length-1-r,n.expression)]:[]),_n=(e,t)=>{if(!e.step)throw new i;return{kind:`Defn`,definition:{kind:`Operator`,name:ot(e.step),body:t,location:e.location},whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:e.location}},vn=(e,t,n)=>{let r=ln(n.step)?`Visible`:`Hidden`,i=t.context.map(e=>e.kind===`Fact`?{...e,visibility:r}:e),a=A({kind:`List`,bullet:`Refs`,items:gn(2,t)},n);return{context:[...e,...i,{kind:`Fact`,expression:dn(n),visibility:`Hidden`,location:n.location},_n(n,a),{kind:`Fact`,expression:A({kind:`Ix`,index:1},n),visibility:`Hidden`,location:n.location}],active:I(3,t.active)}},yn=(e,t,n,r,i)=>{let a=e||ln(i.step)?`Visible`:`Hidden`;return{context:[...t,_n(i,A(he(r),i)),{kind:`Fact`,expression:A({kind:`Ix`,index:1},i),visibility:a,location:i.location}],active:I(2,n)}},bn=(e,t,n)=>{if(n.kind!==`Dx`)throw new s(`Unknown definition ${n.name}`);let r=t.length-n.index,i=t[r];if(!i)return t;if(i.kind!==`Defn`)throw new s(`Indicated point is not a definition`);return t.map((t,n)=>n===r?{...i,visibility:e}:t)},xn=(e,t)=>e.kind===`Apply`&&e.operator.kind===`Internal`&&e.operator.builtin===`Mem`&&e.args[0]?.kind===`Ix`&&e.args[0].index===0&&R(t,e.args[1]),Sn=(e,t,n,r)=>{let i=!1,a=n,o=[...r];for(let e=r.length-1;e>=0;e--){a=I(-1,a);let n=r[e];n.kind===`Fact`&&R(n.expression,a)?(i=!0,o[e]={...n,visibility:t}):n.kind===`Fresh`&&n.domain&&xn(a,n.domain)&&(i=!0,o[e]={...n,domainVisibility:t})}if(!i){let t=`This expression does not appear in the context and cannot be hidden.`;throw e(D(n.location,`${t}\n`)),new s(t,{failure:`proof.Gen.set_expr`})}return o},Cn=(e,t)=>{let n=Te(O(1),t)[1];return n[0].domain.kind===`Ditto`&&e.domain.kind===`Domain`?[{...n[0],domain:{kind:`Domain`,expression:I(1,e.domain.expression)}},...n.slice(1)]:n},wn=(e,t)=>{if(e.isSuppressed||t.length===0)return{kind:`Obvious`,...q(e)};let n=t.map((e,t)=>{let n=I(2*t+2,e);return{kind:`Assert`,sequent:{context:[],active:n},proof:{kind:`By`,usable:{facts:[I(3,n)],defs:[]},isOnly:!1,location:e.location},location:e.location}}),r={kind:`By`,usable:{facts:[A({kind:`Ix`,index:2*t.length+2},e),...t.map((n,r)=>A({kind:`Ix`,index:2*(t.length-r)},e))],defs:[]},isOnly:!0,...q(e)};return{kind:`Steps`,steps:n,qed:{proof:r,location:r.location},...q(e)}},Tn=(e,t,n)=>({sequent:e,location:t.location,kind:n}),En={total:0,absent:[],omitted:[]},Dn=(e,t)=>({total:e.total+t.total,absent:[...e.absent,...t.absent],omitted:[...e.omitted,...t.omitted]}),On=e=>{switch(e.kind){case`Use`:return{...En,total:e.obligations?.length??0};case`Assert`:case`Suffices`:case`Pcase`:case`Pick`:return kn(e.proof);default:return En}},kn=e=>e.kind===`Steps`?[...e.steps.map(On),kn(e.qed.proof)].reduce(Dn):e.kind!==`Omitted`||!e.obligations||!e.location?{...En,total:e.obligations?.length??0}:{total:e.obligations.length,absent:e.omission===`Implicit`?[e.location]:[],omitted:e.omission===`Explicit`?[e.location]:[]},An=(e,t)=>e.kind===`At`&&!e.isExcept?A(we(t),e):Ve(e,e=>An(e,t)),jn=(e,t,n,r)=>{let i=(e,r)=>{let o=r.location;if(!o||!t.has(o.file)||o.endLine<n.start||o.startLine>n.end)return r;switch(r.kind){case`Obvious`:return{...r,obligations:[Tn(e,r,{kind:`Main`})]};case`Omitted`:return{...r,obligations:[Tn(e,r,{kind:`Omitted`,omission:r.omission})]};case`Error`:return{...r,obligations:[Tn(e,r,{kind:`Error`,message:r.message})]};case`By`:throw new s(`Proof.Gen.generate`);case`Steps`:{let[t,n]=N(e,r.steps,a),o=i(t,r.qed.proof);return{...r,steps:n,qed:{...r.qed,proof:o}}}}},a=(e,t)=>{switch(t.kind){case`Forget`:{let n=e.context.length,r=e.context.map((e,r)=>e.kind===`Fact`&&e.visibility===`Visible`&&t.count+r<n?{...e,visibility:`Hidden`}:e);return[{...e,context:r},t]}case`Use`:{let n=t.usable;if(n.defs.length===0&&n.facts.length===1){let r=n.facts[0],i=Tn({...e,active:r},t,{kind:`Support`});return[{context:[...e.context,{kind:`Fact`,expression:r,visibility:`Visible`,location:r.location}],active:I(1,e.active)},{...t,obligations:[i]}]}if(n.facts.length>0)throw new s(`Proof.Gen.gen_step: USE with facts and definitions`);let r=n.defs.reduce((e,t)=>bn(`Visible`,e,t),e.context);return[{...e,context:r},t]}case`Hide`:{let n=t.usable.defs.reduce((e,t)=>bn(`Hidden`,e,t),e.context),i=t.usable.facts.reduceRight((e,t)=>Sn(r,`Hidden`,t,e),n);return[{...e,context:i},t]}case`Define`:return[{context:[...e.context,...t.definitions.map(e=>({kind:`Defn`,definition:e,whereDefined:`User`,visibility:`Visible`,isLocal:!0,location:e.location}))],active:I(t.definitions.length,e.active)},t];case`Assert`:{let n=i(vn(e.context,t.sequent,t),t.proof),r={...t,proof:n};return[yn(!1,e.context,e.active,t.sequent,r),r]}case`Suffices`:{let n=i(yn(!0,e.context,e.active,t.sequent,t),t.proof),r={...t,proof:n};return[vn(e.context,t.sequent,r),r]}default:throw new s(`Proof.Gen.gen_step`)}},o=(e,t,n,r)=>{let i={kind:`Unnamed`,level:0,id:0},[o,s]=a({context:e,active:{...cn,location:r}},t===`Use`?{kind:`Use`,usable:n,isOnly:!1,location:r,step:i}:{kind:`Hide`,usable:n,location:r,step:i});return[o.context,s.obligations??[]]},c=(e,t,n,r)=>{if(n.defs.length===0&&n.facts.length===0)return[e,[]];let i=n.defs.length>0,[a,...s]=n.facts,[l,u]=o(e,t,i?{defs:n.defs,facts:[]}:{defs:[],facts:[a]},r),d=i?n.facts:s.map(e=>I(1,e)),[f,p]=c(l,t,{defs:[],facts:d},r);return[f,[...u,...p]]},l=e=>{let t=[],n=e=>{e.kind===`Steps`?(n(e.qed.proof),e.steps.forEach(r)):e.obligations&&!e.isSuppressed&&t.push(...e.obligations)},r=e=>{e.kind===`Use`&&e.obligations&&!e.isSuppressed&&t.push(...e.obligations),(e.kind===`Assert`||e.kind===`Suffices`||e.kind===`Pcase`||e.kind===`Pick`)&&n(e.proof)};return n(e),t},u=t=>({kind:`Named`,level:t,label:`_a${st(e)}`,isAnonymous:!0}),d=(e,t)=>t?.kind===`Named`?{...t,level:e}:u(e),f=(e,t)=>{let n={...t,step:d(e,t.step)};if(n.kind!==`Steps`)return n;let r=n.steps.map(t=>p(e,t));return{...n,steps:r,qed:{...n.qed,proof:f(e+1,n.qed.proof)}}},p=(e,t)=>{let n={...t,step:d(e,t.step)};switch(n.kind){case`Assert`:case`Suffices`:case`Pcase`:case`Pick`:return{...n,proof:f(e+1,n.proof)};default:return n}},m=(e,t)=>{let n=t.kind===`Apply`?t.operator:t;if(n.kind===`Ix`){let r=e[e.length-n.index];if(!r)throw new s(`expose_connective`);if(r.kind!==`Defn`||r.definition.kind!==`Operator`)return t;let i=I(n.index,r.definition.body);if(t.kind!==`Apply`)return m(e,i);let a={...i,location:t.location};return m(e,A(Ce(a,t.args),a))}if(t.kind===`Apply`&&t.operator.kind===`Internal`&&t.operator.builtin===`Prime`){let n=m(e,t.args[0]),r=e=>j(`Prime`,[e],e);return n.kind===`Quant`?A({kind:`Quant`,quantifier:n.quantifier,bounds:n.bounds.map(e=>e.domain.kind===`Domain`?{...e,domain:{kind:`Domain`,expression:r(e.domain.expression)}}:e),body:r(n.body)},t):fn(n,`Implies`)||fn(n,`Mem`)?A({kind:`Apply`,operator:n.operator,args:[r(n.args[0]),r(n.args[1])]},t):r(n)}return t.kind===`Parens`?m(e,t.expression):t},h=e=>{if(e.kind!==`Assert`)return;let t=e.sequent.active;return t.kind===`Apply`&&t.args.length===2?t.args[1]:void 0},g=e=>{if(e.kind!==`Steps`)return e;let t=[];return e.steps.forEach(e=>{let n=t.at(-1),r=n&&h(n);if(e.kind!==`Assert`||!r){t.push(e);return}let i=An(e.sequent.active,I(2,r));t.push({...e,sequent:{...e.sequent,active:i}})}),{...e,steps:t}},_=(e,t,n)=>{let r=g(n);switch(r.kind){case`Obvious`:case`Omitted`:case`Error`:return r;case`By`:{let e=r.usable,t=e.defs.length===0?[]:[{kind:`Use`,usable:{facts:[],defs:e.defs},isOnly:!1,location:r.location}],n=e.facts.map((e,t)=>({kind:`Use`,usable:{facts:[I(t,e)],defs:[]},isOnly:!1,location:e.location,isSuppressed:r.isSuppressed})),i=r.isOnly?[{kind:`Forget`,count:e.facts.length,location:r.location}]:[],a=un(r.step),o=[...t,...n,...i].map(e=>({...e,step:u(a)})),s={kind:`Obvious`,location:r.location,step:u(a),isSuppressed:r.isSuppressed};return{kind:`Steps`,steps:o,qed:{proof:s,location:s.location,step:s.step},location:r.location,step:r.step,isSuppressed:r.isSuppressed}}case`Steps`:{let n=e,i=t,a=r.steps.flatMap(e=>{let[t,r,a]=v(n,i,e);return n=t,i=r,a}),o=_(n,i,r.qed.proof);return{...r,steps:a,qed:{...r.qed,proof:o}}}}},v=(e,t,n)=>{let r=un(n.step);switch(n.kind){case`Forget`:return[e,t,[n]];case`Assert`:{let r=vn(e,n.sequent,n),i={...n,proof:_(r.context,r.active,n.proof)},a=yn(!1,e,t,n.sequent,i);return[a.context,a.active,[i]]}case`Suffices`:{let r=yn(!0,e,t,n.sequent,n),i={...n,proof:_(r.context,r.active,n.proof)},a=vn(e,n.sequent,i);return[a.context,a.active,[i]]}case`Use`:{let r={kind:`By`,usable:n.usable,isOnly:n.isOnly,location:n.location,step:n.step,isSuppressed:n.isSuppressed},i=_(e,t,r);if(i.kind!==`Steps`)throw new s(`simplifying BY does not produce a non-leaf proof!`);let a=n.usable.facts.map(()=>({kind:`Fact`,expression:cn,visibility:`Visible`,location:n.location}));return[[...e,...a],I(n.usable.facts.length,t),i.steps]}case`Hide`:return[n.usable.defs.reduce((e,t)=>{if(t.kind!==`Dx`)throw new s(`set_vis`);let r=e.length-t.index,i=e[r];if(i?.kind!==`Defn`){let e=i?i.kind===`Fact`?`??? FACT ???`:i.name:``;throw new s(`USE DEF ${e} invalid because ${e} is not a defined operator`)}return e.map((e,t)=>t===r?{...i,visibility:`Hidden`,location:n.location}:e)},e),t,[n]];case`Define`:return[[...e,...n.definitions.map(e=>({kind:`Defn`,definition:e,whereDefined:`Proof`,visibility:`Visible`,isLocal:!0,location:n.location}))],I(n.definitions.length,t),[n]];case`Have`:{let i=m(e,t),a={kind:`Fact`,expression:n.expression,visibility:`Visible`,location:n.location},o=fn(i,`Implies`),s={context:[a],active:o?I(1,i.args[1]):i},c=o?{kind:`By`,usable:{facts:[A({kind:`Ix`,index:2},n)],defs:[]},isOnly:!0,...q(n)}:{kind:`Error`,message:pn(`@.@[<v2>@[%s@ %s@]@,%a@]@.`,`Error: this HAVE step is applied to the following goal,`,`which is not an implication:`,on(e,t)),...q(n)},l=p(r,{kind:`Suffices`,sequent:s,proof:c,location:n.location,step:n.step});return v(e,t,l)}case`Take`:return v(e,t,p(r,ee(e,t,n)));case`Witness`:return v(e,t,p(r,b(e,t,n)));case`Pcase`:{let i={kind:`Assert`,sequent:{context:[{kind:`Fact`,expression:n.expression,visibility:`Visible`,location:n.location}],active:I(1,t)},proof:n.proof,...q(n)};return v(e,t,p(r,i))}case`Pick`:{let r=A({kind:`Quant`,quantifier:`Exists`,bounds:n.bounds,body:n.expression},n),i=y(n.step,`ex`),[a,o,c]=v(e,t,{kind:`Assert`,sequent:{context:[],active:r},proof:n.proof,...q(n),step:i}),l=I(2,r);if(l.kind!==`Quant`)throw new s(`Proof.Simplify.simplify_step/PICK`);let u=[...mn(l.bounds),{kind:`Fact`,expression:l.body,visibility:`Visible`,location:l.body.location}],[d,f,p]=v(a,o,{kind:`Suffices`,sequent:{context:u,active:I(u.length,o)},proof:{kind:`Omitted`,omission:`Elsewhere`,...q(n)},...q(n)});return[d,f,[...c,...p]]}}},y=(t,n)=>({kind:`Named`,level:un(t),label:`${t?.kind===`Named`?t.label:`_a`}${n}${st(e)}`,isAnonymous:!1}),ee=(e,t,n)=>{let r=hn(n.bounds),i=(t,n,r,a)=>{let o=a[0];if(!o)return{aux:n,goal:r};let s=m(e,r);if(s.kind!==`Quant`||s.quantifier!==`Forall`||s.bounds.length===0)return pn(`@.@[<v2>@[<b0>%s@ %s@]@,%a@]@.`,`Error: this TAKE step is applied to the following goal,`,`which is not a universal formula:`,on(e,r));let c=s.bounds[0],l=hn(s.bounds).slice(1),u=o.domain,d=c.domain;if(u.kind===`NoDomain`&&d.kind===`Domain`)return pn(`@.@[<b0>%s (%s)@ %s (%s \\in %a)@]@.`,`Error: the TAKE argument`,o.name,`does not match the pattern`,c.name,on(e,d.expression));if(u.kind===`Domain`&&d.kind===`NoDomain`)return pn(`@.@[<b0>%s (%s \\in %a)@ %s (%s)@]@.`,`Error: the TAKE argument`,o.name,on(e,u.expression),`does not match the pattern`,c.name);let f=u.kind===`Domain`&&d.kind===`Domain`&&!R(u.expression,d.expression)?[{kind:`Apply`,operator:{kind:`Internal`,builtin:`Subseteq`},args:[d.expression,u.expression]},...n]:n;if(l.length===0)return i(1,f,s.body,a.slice(1));let p=a.length===1?l.map(e=>Te(O(t),[e])[1][0]):l;return i(t+1,f,A({kind:`Quant`,quantifier:`Forall`,bounds:p,body:s.body},s),a.slice(1))},a=i(1,[],t,r);if(typeof a==`string`)return{kind:`Suffices`,sequent:{context:[{kind:`Fact`,expression:dn(t),visibility:`Visible`,location:n.location}],active:t},proof:{kind:`Error`,message:a,...q(n)},...q(n)};let o=a.aux.filter((e,t)=>a.aux.findIndex(t=>R(e,t))===t),s=[A({kind:`Ix`,index:2},n),...o.map(e=>I(2,e))];return{kind:`Suffices`,sequent:{context:mn(r),active:a.goal},proof:{kind:`By`,usable:{facts:s,defs:[]},isOnly:!0,...q(n)},...q(n)}},b=(e,t,n)=>{let r=[],i=``,a=t;for(let t of n.expressions){let n=m(e,a);if(n.kind!==`Quant`||n.quantifier!==`Exists`||n.bounds.length===0){i||=pn(`@.@[<v2>@[<b0>%s@ %s@]@,%a@]@.`,`Error: this WITNESS step is applied to the following goal,`,`which is not an existential formula:`,on(e,n)),a=n;break}let[o,...s]=n.bounds,c=s.length===0?n.body:A({kind:`Quant`,quantifier:`Exists`,bounds:Cn(o,s),body:n.body},n),l=t;if(o.domain.kind===`Domain`){let n=o.domain.expression,a=m(e,t);if(fn(a,`Mem`)){let[e,t]=a.args,i=R(t,n)?[]:[j(`Subseteq`,[t,n],t)];r.push(...i,a),l=e}else i||=pn(`@.@[<b0>%s (%a)@ %s (%s \\in %a)@]@.`,`Error: the WITNESS argument`,on(e,a),`does not match the pattern`,o.name,on(e,n)),l=a}let u=j(`Unprimable`,[l],l);a=F(fe(u,O(0)),c)}let o=i===``?wn(n,r):{kind:`Error`,message:i,...q(n)};return{kind:`Suffices`,sequent:{context:[],active:a},proof:o,...q(n)}};return{generate:i,collect:l,mutate:c,simplify:_}},J=(e,t=0)=>({level:e,weights:Array.from({length:t},()=>!0),params:/* @__PURE__ */ new Set}),Mn={TRUE:[0,0],FALSE:[0,0],Implies:[0,2],Equiv:[0,2],Conj:[0,2],Disj:[0,2],Neg:[0,1],Eq:[0,2],Neq:[0,2],STRING:[0,0],BOOLEAN:[0,0],SUBSET:[0,1],UNION:[0,1],DOMAIN:[0,1],Subseteq:[0,2],Mem:[0,2],Notmem:[0,2],Setminus:[0,2],Cap:[0,2],Cup:[0,2],Actplus:[3,2],BoxTrue:[3,1],BoxFalse:[3,1],Diamond:[3,1],Prime:[2,1],StrongPrime:[2,1],ENABLED:[1,1],UNCHANGED:[2,1],Leadsto:[3,2],Cdot:[2,2],Nat:[0,0],Int:[0,0],Real:[0,0],Infinity:[0,0],Plus:[0,2],Minus:[0,2],Times:[0,2],Ratio:[0,2],Quotient:[0,2],Remainder:[0,2],Exp:[0,2],Divides:[0,2],Lteq:[0,2],Lt:[0,2],Gteq:[0,2],Gt:[0,2],Range:[0,2],Uminus:[0,1],Seq:[0,1],Len:[0,1],BSeq:[0,2],Cat:[0,2],Append:[0,2],Head:[0,1],Tail:[0,1],SubSeq:[0,3],SelectSeq:[0,2],OneArg:[0,2],Extend:[0,2],Print:[0,2],PrintT:[0,1],Assert:[0,2],JavaTime:[0,0],TLCGet:[0,1],TLCSet:[0,2],Permutations:[0,1],SortSeq:[0,2],RandomElement:[0,1],Any:[0,0],ToString:[0,1],Unprimable:[0,1]},Nn={Constant:0,State:1,Action:2,Temporal:3,Unknown:0},Pn=e=>new Set(e.flatMap(e=>[...e])),Y=e=>({level:Math.max(0,...e.map(e=>e.level)),weights:[],params:Pn(e.map(e=>e.params))}),Fn=/* @__PURE__ */ new WeakMap,In=e=>{let t=e.hyp;switch(t.kind){case`Flex`:return J(1);case`Fresh`:return{...J(Nn[t.level],t.shape),params:/* @__PURE__ */ new Set([t.name])};case`Defn`:{let n=t.definition;if(n.kind!==`Operator`&&n.kind!==`Bpragma`)throw new i;return X(e.rest,n.body)}case`Fact`:return X(e.rest,t.expression)}},Ln=e=>{let t=Fn.get(e);if(t)return t;let n=In(e);return Fn.set(e,n),n},Rn=(e,t,n)=>{let r=t.flatMap(t=>t.domain.kind===`Domain`?[X(e,t.domain.expression)]:[]),i=t.reduce((e,t)=>M(e,P(t.name,t.level)),e);return Y([X(i,n),...r])},zn=(e,t)=>{if(e.weights.length!==t.length)throw new s(`Invalid number of arguments`);let n=t.filter((t,n)=>e.weights[n]);return{level:Math.max(e.level,...n.map(e=>e.level)),weights:[],params:Pn([e.params,...n.map(e=>e.params)])}},X=(e,t)=>{let n=t=>X(e,t);switch(t.kind){case`Ix`:{let n=ye(e,t.index-1);if(!n)throw new i;return Ln(n)}case`Internal`:{let e=Mn[t.builtin];if(!e)throw new i;return J(e[0],e[1])}case`Opaque`:case`String`:case`Num`:return J(0);case`Lambda`:{let n=t.params.reduce((e,t)=>M(e,P(t.name,`Unknown`,t.shape)),e),r=X(n,t.body),i=new Set(t.params.map(e=>e.name));return{level:r.level,weights:t.params.map(e=>r.params.has(e.name)),params:new Set([...r.params].filter(e=>!i.has(e)))}}case`Apply`:{let e=t.operator;if(e.kind===`Opaque`)return zn(J(0,t.args.length),t.args.map(n));if(e.kind===`Internal`&&t.args.length===1){let r=t.args[0];switch(e.builtin){case`Prime`:case`StrongPrime`:if(n(r).level>1)throw new i;return J(2,1);case`ENABLED`:{let e=n(r);if(e.level>2)throw new i;return{level:1,weights:[],params:e.params}}case`UNCHANGED`:{let e=n(r);if(e.level>1)throw new i;return{level:2,weights:[],params:e.params}}}}return e.kind===`Internal`&&e.builtin===`Cdot`?(t.args.forEach(n),J(2)):e.kind===`Internal`&&e.builtin===`Leadsto`?(t.args.forEach(n),J(3,2)):zn(n(e),t.args.map(n))}case`Sequent`:{let[n,r]=N(e,t.sequent.context,(e,t)=>{let n=M(e,t);return[n,Ln(n).level]});return J(Math.max(0,...r,X(n,t.sequent.active).level))}case`With`:case`Dot`:case`Parens`:return n(t.expression);case`Let`:{let n=t.definitions.reduce((e,t)=>M(e,{kind:`Defn`,definition:t,whereDefined:`User`,visibility:`Visible`,isLocal:!0}),e);return X(n,t.body)}case`If`:return Y([t.condition,t.consequent,t.alternative].map(n));case`List`:return Y(t.items.map(n));case`Quant`:case`Fcn`:return Rn(e,t.bounds,t.body);case`SetOf`:return Rn(e,t.bounds,t.element);case`Tquant`:return X(t.names.reduce((e,t)=>M(e,{kind:`Flex`,name:t}),e),t.body),J(3);case`Choose`:case`SetSt`:{let r=t.domain&&n(t.domain),i=t.domain?be(t.name,t.domain):P(t.name,`Constant`);return Y([X(M(e,i),t.body),...r?[r]:[]])}case`SetEnum`:case`Tuple`:return Y(t.elements.map(n));case`Product`:return Y(t.factors.map(n));case`FcnApp`:return Y([t.function,...t.args].map(n));case`Arrow`:return Y([n(t.domain),n(t.range)]);case`Rect`:case`Record`:return Y(t.fields.map(e=>n(e.value)));case`Except`:return Y([n(t.function),...t.specs.flatMap(e=>[...e.trail.flatMap(e=>e.kind===`Apply`?[n(e.expression)]:[]),n(e.value)])]);case`Sub`:return{...Y([n(t.action),n(t.subscript)]),level:2};case`Tsub`:case`Fair`:return n(t.action),n(t.subscript),J(3);case`Case`:return Y([...t.arms.flatMap(e=>[n(e.condition),n(e.body)]),...t.other?[n(t.other)]:[]]);case`Bang`:case`At`:throw new i}},Bn=(e,t)=>{let n=ye(e,t-1)?.hyp;if(!n)throw new i;return n},Vn=e=>e.kind===`Internal`&&(e.builtin===`ENABLED`||e.builtin===`Cdot`),Hn=e=>e.kind===`Apply`&&e.args.length===1&&e.args[0].kind===`Lambda`&&(Vn(e.operator)||e.operator.kind===`Opaque`&&(e.operator.name===`EnabledWrapper`||e.operator.name===`CdotWrapper`)),Un=e=>e===void 0?2:Math.min(2,e),Wn=e=>e===void 0?void 0:Math.max(1,e-1),Gn=(e,t,n,r)=>{let a=(n,i=r)=>Gn(e,t,n,i);if(Hn(n))return n;if(n.kind===`Sub`)return{...n,action:a(n.action),subscript:a(n.subscript,Wn(r))};if(n.kind===`Apply`&&n.operator.kind===`Internal`){let e=n.operator.builtin,[t,i]=n.args;if(e===`Cdot`&&n.args.length===2)return{...n,args:[a(t,Un(r)),a(i,1)]};if(e===`ENABLED`&&n.args.length===1)return{...n,args:[a(t,Un(r))]};if((e===`Prime`||e===`UNCHANGED`)&&n.args.length===1)return{...n,args:[a(t,Wn(r))]}}let o=n.kind===`Apply`&&n.operator.kind===`Ix`?n.operator:n;if(o.kind!==`Ix`)return Be(t,n,(t,n)=>Gn(e,t,n,r),M);if(r===void 0)return n;let c=X(t,n).level,l=Bn(t,o.index),u=e=>`The operator \`${e}\` is declared at:\n${l.location?le(l.location):`<unknown location>`}`;if(l.kind===`Fresh`&&l.level===`Unknown`)throw e(D(n.location,`Declared operator \`${l.name}\` has unknown level and occurs within the scope of \`ENABLED\` or \`\\cdot\` where soundness requires expanding expressions of level >= ${r}.\nIf a constant operator is substituted for this operator, then the expression that results from applying this declared operator has expression level ${c}.\n May need expansion. A declared operator cannot be expanded.\n${u(l.name)}\n and has arity: ${l.shape}`)),new i(`File "src/expr/e_action.ml", line 367, characters 20-26: Assertion failed`);if(c<r)return n;if(c>2||l.kind===`Fact`)throw new i;if(l.kind===`Flex`){if(n.kind!==`Ix`)throw new i;return n}if(l.kind===`Fresh`){let t=`The expression that results from applying the declared operator \`${l.name}\` has expression level ${c} within the scope of \`ENABLED\` or \`\\cdot\` where soundness requires expanding expressions of level >= ${r}. A declared operator cannot be expanded.\n${u(l.name)}\n and has level: ${Nn[l.level]}\n and arity: ${l.shape}`;throw e(D(n.location,t)),new s(t)}let d=l.definition;if(d.kind!==`Operator`&&d.kind!==`Bpragma`)throw new i;e({text:`${ue(n.location)}[INFO]: Auto-expanding the definition of operator:  ${d.name}\n`,channel:`stdout`});let f=F(O(o.index),d.body);return a(we(n.kind===`Apply`?Ce(f,n.args):f))},Kn=e=>j(`Eq`,[j(`Prime`,[e],e),e],e),qn=e=>{let t=e=>e.kind===`Tuple`?e.elements.flatMap(t):[e],n=t(e);return n.length===0?A({kind:`Internal`,builtin:`TRUE`},e):n.length===1?Kn(n[0]):A({kind:`List`,bullet:`And`,items:n.map(Kn)},e)},Jn=e=>{if(e.kind===`Apply`&&e.args.length===1)return qn(e.args[0]);if(e.kind!==`Sub`)throw new i;let t=qn(e.subscript),n=e.modal===`Box`?t:j(`Neg`,[t],e);return j(e.modal===`Box`?`Disj`:`Conj`,[e.action,n],e)},Yn=e=>{let t=(e,t)=>e<<t|e>>>32-t,n=(e,n)=>{let r=Math.imul(t(Math.imul(n,3432918353),15),461845907);return Math.imul(t(e^r,13),5)+3864292196|0},r=new TextEncoder().encode(e),i=r.length-r.length%4,a=0;for(let e=0;e<i;e+=4)a=n(a,r[e]|r[e+1]<<8|r[e+2]<<16|r[e+3]<<24);let o=r.subarray(i).reduceRight((e,t)=>e<<8|t,0);return r.length>i&&(a=n(a,o)),a^=r.length,a=Math.imul(a^a>>>16,2246822507),a=Math.imul(a^a>>>13,3266489909),(a^a>>>16)&1073741823},Xn=e=>{let t=Array.from({length:16},()=>[]);return e.forEach((e,n)=>{if(t[Yn(e)&t.length-1].unshift(e),n+1<=t.length*2)return;let r=Array.from({length:t.length*2},()=>[]);t.flat().forEach(e=>r[Yn(e)&r.length-1].push(e)),t=r}),t.flat()},Zn=(e,t,n,r,a)=>{let o=i=>Zn(e,t,n,r,i),s=t!==void 0||n!==void 0,c=(i,o)=>{let s={names:[],depth:Math.max(t?.depth??0,n?.depth??0)+1},[c,l]=o,u=[Zn(e,t,s,r,c),...l?[Zn(e,s,n,r,l)]:[]],d=s.names.length===0?[`r#0`]:Xn(s.names);return A({kind:`Apply`,operator:i,args:[{kind:`Lambda`,params:[`_`,...d].map(e=>({name:e,shape:0})),body:u.length===1?u[0]:{kind:`List`,bullet:`And`,items:u}}]},a)};if(Hn(a))return a;if(a.kind===`Apply`&&a.operator.kind===`Internal`){let t=a.operator.builtin;if(t===`ENABLED`&&a.args.length===1||t===`Cdot`&&a.args.length===2)return c(a.operator,a.args);if(t===`Prime`&&a.args.length===1){let t=Zn(e,n,void 0,r,a.args[0]);return n?t:{...a,args:[t]}}if(t===`UNCHANGED`&&s)return o(Jn(a))}if(a.kind===`Sub`&&s)return o(Jn(a));if(a.kind===`Ix`){if(!t)return a;let e=Bn(r,a.index);if(e.kind===`Fact`)throw new i;if(e.kind!==`Flex`)return a;let n=`${e.name}#enabled#prime${t.depth}`;return t.names.includes(n)||t.names.push(n),A({kind:`Opaque`,name:n},a)}if(a.kind===`Apply`&&a.operator.kind===`Opaque`)throw e(D(a.location,`Named operator \`${a.operator.name}\` unexpected after anonymization.`)),new i(`File "src/expr/e_action.ml", line 1048, characters 12-18: Assertion failed`);return Be(r,a,(r,i)=>Zn(e,t,n,r,i),M)},Qn=(e,t)=>{if(t.kind===`Apply`&&Vn(t.operator)){let[n]=t.args;if(t.args.length!==1||n.kind!==`Lambda`)throw new i;let[r,...a]=n.params;if(r.name!==`_`)return t;let o=Qn({kind:`Compose`,outer:e,inner:O(a.length)},n.body);return{kind:`Apply`,operator:t.operator,args:[{kind:`Lambda`,params:a,body:o}]}}return t.kind===`Ix`?F(e,t):t.kind===`Apply`?A(Ce(Qn(e,t.operator),t.args.map(t=>Qn(e,t))),t):Be(e,t,Qn,e=>k(1,e))},$n=e=>{if(e.kind===`Apply`&&Vn(e.operator)){let[t]=e.args;if(e.args.length!==1||t.kind!==`Lambda`||t.params[0].name===`_`)throw new i;let n=e.operator.builtin===`Cdot`?`CdotWrapper`:`EnabledWrapper`;return{kind:`Apply`,operator:A({kind:`Opaque`,name:n},e.operator),args:[{kind:`Lambda`,params:t.params.map((e,t)=>({name:`r#${t}`,shape:0})),body:$n(t.body)}]}}return Be(void 0,e,(e,t)=>$n(t),()=>void 0)},er=e=>{if(e.kind===`Apply`&&e.operator.kind===`Internal`&&e.operator.builtin===`Cdot`&&e.args.length===1&&e.args[0].kind!==`Lambda`)throw new i;return Be(void 0,e,(e,t)=>er(t),()=>void 0)},tr=(e,t,n,r)=>{let i=Gn(t,n,r,void 0),a=Qn(O(0),Zn(t,void 0,void 0,n,i));return er($n(e.expr(n,a)))},nr=(e,t)=>({kind:`Definition`,definition:{kind:`Operator`,name:e,body:{kind:`Internal`,builtin:t}},whereDefined:`Builtin`,visibility:`Visible`,isLocal:!1}),Z=(e,t,n)=>({kind:`Definition`,definition:{kind:`Operator`,name:t,body:{kind:`Lambda`,params:Array.from({length:e},(e,t)=>({name:`x${t+1}`,shape:0})),body:{kind:`Apply`,operator:{kind:`Internal`,builtin:n},args:Array.from({length:e},(t,n)=>({kind:`Ix`,index:e-n}))}}},whereDefined:`Builtin`,visibility:`Visible`,isLocal:!1}),rr=[nr(`Nat`,`Nat`),Z(2,`+`,`Plus`),Z(2,`-`,`Minus`),Z(2,`*`,`Times`),Z(2,`^`,`Exp`),Z(2,`<`,`Lt`),Z(2,`>`,`Gt`),Z(2,`=<`,`Lteq`),Z(2,`>=`,`Gteq`),Z(2,`%`,`Remainder`),Z(2,`\\div`,`Quotient`),Z(2,`..`,`Range`)],ir=[...rr,nr(`Int`,`Int`),Z(1,`-.`,`Uminus`)],ar=[...ir,nr(`Real`,`Real`),Z(2,`/`,`Ratio`),nr(`Infinity`,`Infinity`)],or=[Z(1,`Seq`,`Seq`),Z(1,`Len`,`Len`),Z(2,`BSeq`,`BSeq`),Z(2,`\\o`,`Cat`),Z(2,`Append`,`Append`),Z(1,`Head`,`Head`),Z(1,`Tail`,`Tail`),Z(3,`SubSeq`,`SubSeq`),Z(2,`SelectSeq`,`SelectSeq`)],sr=[Z(2,`Print`,`Print`),Z(1,`PrintT`,`PrintT`),Z(2,`Assert`,`Assert`),nr(`JavaTime`,`JavaTime`),Z(1,`TLCGet`,`TLCGet`),Z(2,`TLCSet`,`TLCSet`),Z(2,`:>`,`OneArg`),Z(2,`@@`,`Extend`),Z(1,`Permutations`,`Permutations`),Z(2,`SortSeq`,`SortSeq`),Z(1,`RandomElement`,`RandomElement`),nr(`Any`,`Any`),Z(1,`ToString`,`ToString`)],cr=(e,t)=>({name:e,extendees:[],body:t,isImportant:!1,isStandard:!0}),lr=new Map([cr(`Naturals`,rr),cr(`Integers`,ir),cr(`Reals`,ar),cr(`Sequences`,or),cr(`TLC`,sr)].map(e=>[e.name,e])),ur=e=>{let t=e.location;switch(e.kind){case`Constants`:return e.declarations.map(e=>({kind:`Fresh`,name:e.name,shape:e.shape,level:`Constant`,domain:void 0,domainVisibility:`Visible`,location:t}));case`Recursives`:return e.declarations.map(e=>({kind:`Defn`,definition:{kind:`Recursive`,name:e.name,shape:e.shape,location:t},whereDefined:`User`,visibility:`Hidden`,isLocal:!1,location:t}));case`Variables`:return e.names.map(e=>({kind:`Flex`,name:e,location:t}));case`Definition`:return[{kind:`Defn`,definition:e.definition,whereDefined:e.whereDefined,visibility:e.visibility,isLocal:e.isLocal,location:t}];case`Axiom`:return e.name===void 0?[{kind:`Fact`,expression:e.expression,visibility:`Hidden`,location:t}]:fr(e.name,e.expression,t);case`Theorem`:{let n=Oe(O(-e.axiomCount),{...e.sequent,context:e.sequent.context.slice(e.axiomCount)}),r=A(he(n),e);return e.name===void 0?[{kind:`Fact`,expression:r,visibility:`Hidden`,location:t}]:fr(e.name,r,t)}case`Mutate`:return e.mode===`Use`?e.usable.facts.map((e,n)=>({kind:`Fact`,expression:I(n,e),visibility:`Visible`,location:t})):[];case`Submod`:case`Anoninst`:return[]}},dr=e=>e.kind===`Axiom`||e.kind===`Theorem`?e.name===void 0?1:2:ur(e).length,fr=(e,t,n)=>[{kind:`Defn`,definition:{kind:`Operator`,name:e,body:t,location:n},whereDefined:`User`,visibility:`Visible`,isLocal:!1,location:n},{kind:`Fact`,expression:{kind:`Ix`,index:1,location:n},visibility:`Hidden`,location:n}],pr=e=>e.body.flatMap(e=>{switch(e.kind){case`Definition`:return[{...e,whereDefined:e.isLocal?`Builtin`:e.whereDefined}];case`Mutate`:return[];case`Theorem`:return[{...e,proof:{kind:`Omitted`,omission:`Elsewhere`,location:e.location}}];case`Submod`:return[{...e,module:{...e.module,body:pr(e.module)}}];default:return[e]}}),mr=(e,t,n,r=/* @__PURE__ */ new Set([t.name]))=>{let a=[];for(let o of t.extendees){if(n.has(o))continue;if(r.has(o))throw new i(`Stack overflow`);let t=e.get(o);if(!t)throw new s(`Module "${o}" unknown`);a.push(...pr(mr(e,t,n,/* @__PURE__ */ new Set([...r,o])))),n.add(o)}return{...t,body:[...a,...t.body].map(t=>t.kind===`Submod`?{...t,module:mr(e,t.module,/* @__PURE__ */ new Set)}:t)}},hr=e=>{let t=/* @__PURE__ */ new Map,n=(e,n)=>{t.has(e)||t.set(e,n)},r=e=>e.extendees.forEach((t,r)=>n(t,e.extendeeLocations?.[r])),i=/* @__PURE__ */ new Set,a=/* @__PURE__ */ new Map,o=e=>{typeof e==`object`&&e&&(`instance`in e&&gr(e.instance)&&n(e.instance.module,e.instance.location),Object.values(e).forEach(o))},s=e=>{e.kind===`Theorem`?o(e.sequent):e.kind!==`Submod`&&o(e),e.kind===`Submod`&&(i.add(e.module.name),a.set(e.module.name,e.module),r(e.module),e.module.body.forEach(s))};return e.body.forEach(s),i.forEach(e=>t.delete(e)),r(e),{dependencies:[...t.keys()].sort(_r),locations:t,submodules:a}},gr=e=>typeof e==`object`&&!!e&&`module`in e&&typeof e.module==`string`&&`substitutions`in e,_r=(e,t)=>e<t?-1:+(e>t),vr=(e,t)=>({facts:Se(e,t.facts),defs:t.defs.map(t=>{if(t.kind===`Dvar`)return t;let n=F(e,{kind:`Ix`,index:t.index});if(n.kind!==`Ix`)throw new s(`substitution produced bad definition`);return{...t,index:n.index}})}),yr=(e,t)=>{switch(t.kind){case`Constants`:case`Recursives`:return[k(t.declarations.length,e),t];case`Variables`:return[k(t.names.length,e),t];case`Definition`:return[k(1,e),{...t,definition:Ee(e,t.definition)}];case`Axiom`:return[k(dr(t),e),{...t,expression:F(e,t.expression)}];case`Theorem`:return[k(dr(t),e),{...t,sequent:Oe(e,t.sequent)}];case`Submod`:return[e,{...t,module:{...t.module,body:br(e,t.module.body)}}];case`Mutate`:return[t.mode===`Hide`?e:k(t.usable.facts.length,e),{...t,usable:vr(e,t.usable)}];case`Anoninst`:return[e,{...t,instance:{...t.instance,substitutions:t.instance.substitutions.map(t=>({name:t.name,expression:F(e,t.expression)}))}}]}},br=(e,t)=>N(e,t,yr)[1],xr=(e,t,n,r)=>{try{let n=tr(e.anonymizer,e.onWarning,t,{kind:`Sequent`,sequent:r});if(n.kind!==`Sequent`)throw new i;return n.sequent}catch(t){if(!(t instanceof s)||t.failure===void 0)throw t;let i=r.active.location,a=`${t.failure}\nCould not instantiate the theorem ${n===void 0?``:`named: ${n}, `}at: ${i?le(i):`<unknown location>`}`;return e.onWarning({text:`${ue(i)}[ERROR]${a}`,channel:`stdout`}),e.onWarning({text:a,channel:`toolboxOnly`}),{context:[],active:A({kind:`Internal`,builtin:`TRUE`},r.active)}}},Sr=(e,t,n)=>{if(n.kind===`Theorem`)return{...n,sequent:xr(e,t,n.name,n.sequent)};if(n.kind!==`Definition`)return n;let r=n.definition;if(r.kind!==`Operator`&&r.kind!==`Bpragma`)return n;let i=tr(e.anonymizer,e.onWarning,t,r.body);return{...n,definition:{...r,body:i}}},Cr=(e,t,n)=>N(t,n,(t,n)=>{if(n.kind===`Submod`){let[r,i]=Cr(e,t,n.module.body);return[r,{...n,module:{...n.module,body:i}}]}let r=Sr(e,t,n);return[ge(t,ur(r)),r]}),wr=(e,t)=>{let n=[],r=0,i=e;for(;i.length>0;){let[e,...a]=i,o=e.kind===`Constants`?{name:e.declarations[0].name,remaining:{...e,declarations:e.declarations.slice(1)}}:e.kind===`Variables`?{name:e.names[0],remaining:{...e,names:e.names.slice(1)}}:void 0;if(o){let e=t.get(o.name);if(!e)throw new s(`Parameter ${o.name} has no substitute`);let n=dr(o.remaining)===0;i=br(fe(I(r,e),O(0)),n?a:[o.remaining,...a])}else n.push(e),r+=dr(e),i=a}return n},Tr=(e,t,n)=>{let r=Array.from({length:t},(e,r)=>A({kind:`Ix`,index:t-r},{location:n})),i=Array.from({length:t},(e,t)=>A({kind:`Ix`,index:t+1},{location:n})),a=Array.from({length:e},(e,i)=>{let a=A({kind:`Ix`,index:i+t+1},{location:n});return t>0?A({kind:`Apply`,operator:a,args:r},{location:n}):a});return pe([...a,...i].reverse(),O(e+t))},Er=(e,t)=>{let n=t.map(e=>({name:e,shape:0}));return e.kind===`Lambda`?{...e,params:[...n,...e.params]}:t.length===0?e:A({kind:`Lambda`,params:n,body:e},e)},Dr=(e,t,n,r,i,a)=>{let o=e=>n===``?e:`${n}!${e}`,c=r.args.length,l=[],u=0,d=t,f=c===0,p=t=>{f||(f=!0,e.onWarning({text:t,channel:`stderr`}))};for(;d.length>0;){let[t,...n]=d;d=n;let f=e=>Er(F(Tr(u,c,a),e),r.args);switch(t.kind){case`Definition`:{let n=t.definition;if(n.kind!==`Operator`&&n.kind!==`Bpragma`)throw new s(`Module.Elab.localize`);let r=t.isLocal?`${n.name}$${st(e.salts)}`:n.name;l.push({...t,definition:{...n,name:o(r),body:f(n.body)},whereDefined:t.isLocal?`Builtin`:t.whereDefined,isLocal:t.isLocal||i}),u+=1;continue}case`Axiom`:{p(`${de(a)}Instancing produces parametric axioms.\nSuch axioms will be forcibly hidden and cannot be cited.\n(This warning appears at-most once per INSTANCE declaration.)`);let e={...t,name:t.name===void 0?void 0:o(t.name),expression:f(t.expression)};l.push(e),u+=dr(e);continue}case`Theorem`:{p(`${ue(a)}Warning: Instancing produces parametric theorems.\nSuch theorems will be forcibly hidden and cannot be cited.\n(This warning appears at-most once per INSTANCE declaration.)`);let e=f(A(he(t.sequent),t));l.push({...t,name:t.name===void 0?void 0:o(t.name),sequent:e.kind===`Sequent`?e.sequent:{context:[],active:e},proof:{kind:`Omitted`,omission:`Elsewhere`,location:t.location}}),u+=1;continue}case`Mutate`:t.mode===`Use`&&(d=br(O(-t.usable.facts.length),d));continue;case`Submod`:continue;default:throw new s(`Module.Elab.localize`)}}return l},Or=e=>{let t=[],n=e;for(;n.length>0;){let[e,...r]=n;if(e.kind!==`Axiom`){t.push(e),n=r;continue}let i=e.location;e.name!==void 0&&t.push({kind:`Definition`,definition:{kind:`Operator`,name:e.name,body:e.expression,location:i},whereDefined:`Proof`,visibility:`Visible`,isLocal:!1,location:i});let a={kind:`Fact`,expression:e.name===void 0?I(1,e.expression):A({kind:`Ix`,index:2},e),visibility:`Visible`,location:i},o=0,s=r.map(e=>{let t=o;if(o+=dr(e),e.kind!==`Theorem`)return e;let n=Oe(O(1),e.sequent);return{...e,sequent:{...n,context:[De(O(t),a),...n.context]},axiomCount:e.axiomCount+1}});n=br(O(-1),s)}return t},kr=e=>new Set(e.body.flatMap(e=>e.kind===`Constants`?e.declarations.map(e=>e.name):e.kind===`Variables`?e.names:[])),Ar=(e,t,n,r,i,a,o)=>{let c=t.get(r.module);if(!c)throw new s(`Module "${r.module}" unknown`);let l=kr(c);for(let e of r.substitutions)if(!l.has(e.name))throw new s(`Parameter ${e.name} occurs in the statement \`INSTANCE ${r.module} WITH\`, and is not declared in the module ${r.module}`);let u=ge(n,r.args.map(e=>P(e,`Unknown`))),d=new Map(r.substitutions.map(e=>[e.name,e.expression]));for(let e of[...l].sort(_r))if(!d.has(e)){if(!ve(u,e))throw new s(`Required parameter ${e} for module ${r.module} could not be inferred.`);d.set(e,A({kind:`Opaque`,name:e},{location:o}))}let f=new Map([...d].map(([t,n])=>[t,e.anonymizer.expr(u,n)])),p=br(O((u?.size??0)-(c.depth??0)),c.body.map(e=>e.kind===`Theorem`?{...e,proof:{kind:`Omitted`,omission:`Implicit`,location:e.proof.location}}:e)),[,m]=Cr(e,u,p);return Or(Dr(e,wr(m,f),a,r,i,o))},jr=(e,t,n)=>e===void 0?{hyps:[],sequent:t}:{hyps:[{kind:`Defn`,definition:{kind:`Operator`,name:e,body:A(he(t),{location:n}),location:n},whereDefined:`Proof`,visibility:`Visible`,isLocal:!1,location:n}],sequent:Oe(O(1),t)},Mr=(e,t,n)=>{let r=n.instance.module;if(!e.latestModules.has(r))throw e.onWarning({text:`${de(n.instance.location)}Module ${JSON.stringify(r)} unknown\n`,channel:`toolbox`}),new s(`Module ${JSON.stringify(r)} unknown`,{failure:`Module.Elab.anon#defns`});let i=Ar(e,e.latestModules,t,n.instance,!0,n.name,n.location),a=[],o=i;for(;o.length>0;){let[e,...t]=o;e.kind===`Definition`?(a.push(e.definition),o=t):o=br(O(-dr(e)),t)}return a},Nr=(e,t,n,r)=>{let i=[],a=n,o=e=>{i.push(e),a=ge(a,ur(e))},s=e=>e!==void 0&&ve(a,e)!==void 0,c=r.body.map(e=>({unit:e,isAnonymized:!1}));for(let n=0;n<c.length;n++){let i=c[n].unit,l=(r,o,s)=>{let l=Ar(e,t,a,r,o,s,i.location);c.splice(n+1,0,...l.map(e=>({unit:e,isAnonymized:!0})))};switch(i.kind){case`Anoninst`:l(i.instance,i.isLocal,``);continue;case`Definition`:{let t=i.definition;if(t.kind===`Instance`){l(t.instance,i.isLocal,t.name);continue}let r=t.kind===`Recursive`||c[n].isAnonymized?t:e.anonymizer.defn(a,t),s={...i,definition:r};if(t.kind===`Recursive`){o(s);continue}let u=ur(s)[0],d=ve(a,t.name);if(d?.hyp.kind===`Defn`&&(d.hyp.definition.kind===`Recursive`||Ne(De(O(d.depth+1),d.hyp),u))){let e=c.slice(n+1),t=br(fe(A({kind:`Ix`,index:d.depth+1},i),O(0)),e.map(e=>e.unit));c.splice(n+1,e.length,...e.map((e,n)=>({...e,unit:t[n]})));continue}o(s);continue}case`Recursives`:case`Constants`:case`Variables`:o(i);continue;case`Axiom`:if(s(i.name))continue;e.latestModules=new Map(t),o({...i,expression:e.anonymizer.expr(a,i.expression)});continue;case`Theorem`:{let n=s(i.name),c=n?`(redundant)${i.name}`:i.name,l=n?{kind:`Obvious`,location:i.proof.location}:i.proof;e.latestModules=new Map(t);let u=e.anonymizer.sequent(a,i.sequent),d=jr(c,u,i.location),f=ge(ge(a,d.hyps),d.sequent.context),p=e.anonymizer.proof(f,l),m=r.isImportant?e.generator.simplify(_e(f),d.sequent.active,p):p;o({...i,name:c,sequent:u,proof:m});continue}case`Mutate`:e.latestModules=new Map(t),o({...i,usable:e.anonymizer.usable(a,i.usable)});continue;case`Submod`:o({...i,module:Nr(e,t,a,i.module)});continue}}let l={...r,body:i,depth:n?.size??0};return t.set(r.name,l),l},Pr=(e,t,n)=>{let r=[],i=[],a=En,o=t;for(let t of n.body)switch(t.kind){case`Theorem`:{let n=jr(t.name,t.sequent,t.location),s=[...o,...n.hyps],c=e.generator.generate({context:[...s,...n.sequent.context],active:n.sequent.active},t.proof);r.push(...e.generator.collect(c));let l=kn(c);i.push({...l,location:t.location}),a=Dn(a,l);let u=t.name===void 0?A(he(t.sequent),t):{kind:`Ix`,index:1,location:t.location};o=[...s,{kind:`Fact`,expression:u,visibility:`Hidden`,location:t.location}];continue}case`Submod`:{let n=Pr(e,o,t.module);r.push(...n.obligations),a=Dn(a,n.summary);continue}case`Mutate`:{let[n,i]=e.generator.mutate(o,t.mode,t.usable,t.location);r.push(...i),o=n;continue}default:o=[...o,...ur(t)]}return{obligations:r,summary:{...a,theorems:i}}},Fr=e=>({kind:`Opaque`,name:e}),Ir=e=>({kind:`Tuple`,elements:e.map(Fr)}),Lr=(e,t)=>({kind:`Apply`,operator:{kind:`Internal`,builtin:`Eq`},args:[e,t]}),Rr=e=>e.map(e=>({name:e,level:`Constant`,domain:{kind:`NoDomain`}})),zr=(e,t)=>e?.kind===`Product`&&e.factors.length===t.length?e.factors:void 0,Br=(e,t)=>t.map((t,n)=>({kind:`Operator`,name:t,body:{kind:`FcnApp`,function:Fr(e),args:[{kind:`Num`,integer:String(n+1),fraction:``}]}})),Vr=(e,t)=>e.map((e,n)=>({name:e,level:`Constant`,domain:{kind:`Domain`,expression:t[n]}})),Hr=e=>({name:e.name,level:`Constant`,domain:e.domain}),Ur=(e,t,n)=>{let r=[];return t.forEach(e=>{e.kind===`Name`&&e.domain.kind===`Ditto`?r.at(-1)?.push(e):r.push([e])}),r.reduceRight((t,n)=>{let r=n[0];if(r.kind===`Name`)return{kind:`Quant`,quantifier:e,bounds:n.flatMap(e=>e.kind===`Name`?[Hr(e)]:[]),body:t,location:t.location};let i=zr(r.domain,r.names);if(i)return{kind:`Quant`,quantifier:e,bounds:Vr(r.names,i),body:t,location:t.location};let a={kind:`Apply`,operator:{kind:`Internal`,builtin:e===`Exists`?`Mem`:`Notmem`},args:[Ir(r.names),r.domain]};return{kind:`Quant`,quantifier:e,bounds:Rr(r.names),body:{kind:`List`,bullet:e===`Exists`?`And`:`Or`,items:[a,t]},location:t.location}},n)},Wr=(e,t,n,r)=>zr(n,t)?{kind:`Let`,definitions:Br(e,t),body:r}:{kind:`Quant`,quantifier:`Exists`,bounds:Rr(t),body:{kind:`List`,bullet:`And`,items:[Lr(Fr(e),Ir(t)),r]}},Gr=(e,t,n)=>{let r=`choose#${e[0]}`;return{kind:`Choose`,name:r,domain:t,body:Wr(r,e,t,n)}},Kr=(e,t,n)=>{let r=`setst#${e[0]}`;return{kind:`SetSt`,name:r,domain:t,body:Wr(r,e,t,n)}},qr=(e,t,n)=>{let r=e.map(e=>{if(e.kind===`Name`)return{bounds:[Hr(e)],definitions:[]};let t=zr(e.domain,e.names);if(t&&n)return{bounds:Vr(e.names,t),definitions:[]};let r=`fcn#${e.names[0]}`,i={name:r,level:`Constant`,domain:{kind:`Domain`,expression:e.domain}};if(t)return{bounds:[i],definitions:Br(r,e.names)};let a=`choose#${r}`;return{bounds:[i],definitions:[{kind:`Operator`,name:a,body:Gr(e.names,void 0,Lr(Fr(r),Ir(e.names)))},...Br(a,e.names)]}}),i=r.flatMap(e=>e.definitions);return{bounds:r.flatMap(e=>e.bounds),value:i.length===0?t:{kind:`Let`,definitions:i,body:t}}},Jr=(e,t)=>{let n=qr(t,e,!0);return{kind:`SetOf`,element:n.value,bounds:n.bounds}},Yr=(e,t)=>{let n=qr(e,t,!1);return{kind:`Fcn`,bounds:n.bounds,body:n.value}},Xr={"=>":`Implies`,"<=>":`Equiv`,"/\\":`Conj`,"\\/":`Disj`,"~":`Neg`,"=":`Eq`,"#":`Neq`,SUBSET:`SUBSET`,UNION:`UNION`,DOMAIN:`DOMAIN`,"\\subseteq":`Subseteq`,"\\in":`Mem`,"\\notin":`Notmem`,"\\":`Setminus`,"\\cap":`Cap`,"\\cup":`Cup`,"'":`Prime`,"~>":`Leadsto`,ENABLED:`ENABLED`,UNCHANGED:`UNCHANGED`,"\\cdot":`Cdot`,"-+->":`Actplus`,"[]":`BoxTrue`,"<>":`Diamond`,TRUE:`TRUE`,FALSE:`FALSE`,BOOLEAN:`BOOLEAN`,STRING:`STRING`},Q=(e,t=!1)=>t&&e===`-`?`-.`:H(e).name,Zr=/^<(\d+|\*|\+)>([A-Za-z0-9_]*)\.*$/,$=(e,t)=>{if(!e||!t)return e??t;let n=e.startLine<t.startLine||e.startLine===t.startLine&&e.startColumn<=t.startColumn,r=e.endLine>t.endLine||e.endLine===t.endLine&&e.endColumn>=t.endColumn;return{file:e.file,startLine:n?e.startLine:t.startLine,startColumn:n?e.startColumn:t.startColumn,endLine:r?e.endLine:t.endLine,endColumn:r?e.endColumn:t.endColumn}},Qr={Always:`[]`,Eventually:`<>`,Enabled:`ENABLED`,Unchanged:`UNCHANGED`},$r=(e,t)=>e!==void 0&&t!==void 0&&e.line===t.line&&e.column===t.column,ei=e=>e.location.range?.start,ti=e=>e.location.range?.end,ni=(e,t)=>{let n=e.location.range;return n&&t?{...e,location:{...e.location,range:{...n,end:t}}}:e},ri=e=>{if(e.kind===`Apply`){let t=H(e.operator),n=e.args.length===2&&t.fixity.startsWith(`Infix`),r=e.args.length===1&&t.fixity===`Prefix`;if(!n&&!r)return;let i=e.args.length-1;return{operator:t,isInfix:n,operand:e.args[i],replace:t=>({...e,args:[...e.args.slice(0,i),t]})}}let t=Qr[e.kind];if(t!==void 0&&`expression`in e)return{operator:H(t),isInfix:!1,operand:e.expression,replace:t=>({...e,expression:t})}},ii=(e,t)=>e.high<t.low,ai=e=>{let t=H(e.operator),[n,r]=e.args,i=ti(e),a=t=>{let n=e.location.range,i=ei(t);return{...e,args:[t,r],location:n&&i?{...e.location,range:{...n,start:i}}:e.location}},o=(e,n)=>{let r=n?ri(e):void 0;if(!r)return{kind:`Reduced`,isFinal:!1};let s=o(r.operand,$r(ti(r.operand),ti(e)));return s.kind===`Attached`?{kind:`Attached`,expression:ni(r.replace(s.expression),i)}:!s.isFinal&&(ii(t,r.operator)||r.isInfix&&t.fixity===`InfixLeft`&&r.operator.fixity===`InfixLeft`&&!ii(r.operator,t))?{kind:`Reduced`,isFinal:!ii(t,r.operator)}:{kind:`Attached`,expression:ni(r.replace(a(r.operand)),i)}},s=o(n,$r(ei(n),ei(e)));return s.kind===`Attached`?s.expression:e},oi="use instead the class`E_visit.iter_concrete`",si=(e,t,n,r)=>{let i=t.split(`
+`),a=t=>({file:e,startLine:t.start.line,startColumn:t.start.column,endLine:t.end.line,endColumn:t.end.column+1}),o=e=>{let t={line:e.endLine-1,column:e.endColumn-1},n=e=>e===` `||e===`\r`;for(;t.line<i.length;){let e=i[t.line];for(;n(e[t.column]);)t.column++;if(t.column<e.length)break;t.line++,t.column=0}if(!(i[t.line]??``).startsWith(`(*{`,t.column))return e;for(let n=t.line;n<i.length;n++){let r=i[n].indexOf(`}*)`,n===t.line?t.column:0);if(r!==-1)return{...e,endLine:n+1,endColumn:r+4}}return e},c=(t,n)=>({file:e,startLine:n.line,startColumn:n.column,endLine:n.line,endColumn:n.column+t.length}),l=t=>t.range?a(t.range):{file:e,startLine:t.line,startColumn:t.column,endLine:t.line,endColumn:t.column+1},d=(e,t)=>{let n=Q(e),r=Xr[n];return A(r?{kind:`Internal`,builtin:r}:{kind:`Opaque`,name:n},{location:t})},f=(e,t,n,r)=>{if(e.startsWith(`<`)){let t=A({kind:`Opaque`,name:e},{location:n});return A({kind:`Bang`,expression:t,selectors:[]},{location:n})}let i=Xr[e];if(i&&t.length===0)return A({kind:`Internal`,builtin:i},{location:n});let a=e.split(`!`);if(a.length===1){let r=A({kind:`Opaque`,name:e},{location:n});return t.length===0?r:A({kind:`Apply`,operator:r,args:t},{location:n})}let o=r??a.map((e,n)=>n===a.length-1?t.length:0),s=o.map((e,t)=>o.slice(0,t).reduce((e,t)=>e+t,0)),c=e=>t.slice(s[e],s[e]+o[e]),l=A({kind:`Opaque`,name:a[0]},{location:n});return A({kind:`Bang`,expression:o[0]===0?l:A({kind:`Apply`,operator:l,args:c(0)},{location:n}),selectors:a.slice(1).map((e,t)=>({kind:`Label`,label:Q(e),args:c(t+1)}))},{location:n})},p=(e,t)=>e.map((n,r)=>{if(n.pattern.kind===`Tuple`)throw new s(`Unexpected tuple declaration`,{failure:oi});let i=r>0&&e[r-1].set===n.set;return{name:n.pattern.name,level:`Constant`,domain:i?{kind:`Ditto`}:{kind:`Domain`,expression:_(n.set,t)}}}),m=(e,t)=>e.map((n,r)=>{let i=_(n.set,t);if(n.pattern.kind===`Tuple`)return{kind:`Tuple`,names:n.pattern.names,domain:i};let a=r>0&&e[r-1].set===n.set;return{kind:`Name`,name:n.pattern.name,domain:a?{kind:`Ditto`}:{kind:`Domain`,expression:i}}}),h=(e,t)=>{if(!r)throw new s(`Unexpected tuple declaration`,{failure:oi});return A(e(),{location:t})},g=e=>e.some(e=>e.pattern.kind===`Tuple`),_=(e,t)=>{let n=l(e.location),r=e=>_(e,t),i=(e,t)=>e.length===2?$(e[0].location,e[1].location):e.length!==1||!e[0].location?n:t===`Prefix`?$({...n,endLine:n.startLine,endColumn:n.startColumn+1},e[0].location):t===`Postfix`?$({...n,startLine:n.endLine,startColumn:n.endColumn-1},e[0].location):n,a=(e,t)=>A({kind:`Apply`,operator:{kind:`Internal`,builtin:e},args:[t]},{location:i([t],`Prefix`)});switch(e.kind){case`Number`:return A({kind:`Num`,integer:e.text??String(e.value),fraction:``},{location:n});case`Decimal`:{let[t,r]=e.text.split(`.`);return A({kind:`Num`,integer:t,fraction:r},{location:n})}case`String`:return A({kind:`String`,value:e.value},{location:n});case`Identifier`:return f(e.name,[],n);case`Apply`:{if(e.args.length===2){let t=ai(e);if(t!==e)return r(t)}let t=e.args.map(r),a=H(e.operator);return a.fixity===`Nonfix`?f(e.operator,t,n,e.argumentCounts):A({kind:`Apply`,operator:d(e.operator,void 0),args:t},{location:i(t,a.fixity)})}case`OperatorReference`:return d(e.operator,n);case`Lambda`:return A({kind:`Lambda`,params:e.params.map(e=>({name:e,shape:0})),body:r(e.body)},{location:n});case`And`:case`Or`:{let t=e.operands.map(r);if(e.isBulleted)return A({kind:`List`,bullet:e.kind,items:t},{location:n});let i=e.kind===`And`?`Conj`:`Disj`;return t.reduce((e,t)=>A({kind:`Apply`,operator:{kind:`Internal`,builtin:i},args:[e,t]},{location:$(e.location,t.location)}))}case`Prime`:{let t=r(e.expression);return A({kind:`Apply`,operator:{kind:`Internal`,builtin:`Prime`},args:[t]},{location:i([t],`Postfix`)})}case`Unchanged`:return a(`UNCHANGED`,r(e.expression));case`Enabled`:return a(`ENABLED`,r(e.expression));case`If`:return A({kind:`If`,condition:r(e.condition),consequent:r(e.consequent),alternative:r(e.alternative)},{location:n});case`Case`:return A({kind:`Case`,arms:e.arms.map(e=>({condition:r(e.condition),body:r(e.body)})),other:e.other&&r(e.other)},{location:n});case`Let`:return A({kind:`Let`,definitions:[...e.definitions,...e.instances??[]].sort((e,t)=>e.location.line-t.location.line||e.location.column-t.location.column).map(e=>y(e,t)),body:r(e.body)},{location:n});case`Forall`:case`Exists`:if(g(e.bounds)){let i=m(e.bounds,t),a=r(e.body);return h(()=>Ur(e.kind,i,a),n)}return A({kind:`Quant`,quantifier:e.kind,bounds:p(e.bounds,t),body:r(e.body)},{location:n});case`UnboundedQuantifier`:{let t=r(e.body),i=e.quantifier;return e.isTemporal?A({kind:`Tquant`,quantifier:i,names:e.names,body:t},{location:n}):A({kind:`Quant`,quantifier:i,bounds:Rr(e.names),body:t},{location:n})}case`Choose`:if(e.pattern.kind===`Tuple`){let t=e.pattern.names,i=e.set&&r(e.set),a=r(e.body);return h(()=>Gr(t,i,a),n)}return A({kind:`Choose`,name:e.pattern.name,domain:e.set&&r(e.set),body:r(e.body)},{location:n});case`SetEnumeration`:return A({kind:`SetEnum`,elements:e.elements.map(r)},{location:n});case`SetFilter`:if(e.bound.pattern.kind===`Tuple`){let t=e.bound.pattern.names,i=r(e.bound.set),a=r(e.predicate);return h(()=>Kr(t,i,a),n)}return A({kind:`SetSt`,name:e.bound.pattern.name,domain:r(e.bound.set),body:r(e.predicate)},{location:n});case`SetMap`:if(g(e.bounds)){let i=r(e.expression),a=m(e.bounds,t);return h(()=>Jr(i,a),n)}return A({kind:`SetOf`,element:r(e.expression),bounds:p(e.bounds,t)},{location:n});case`Tuple`:return A({kind:`Tuple`,elements:e.elements.map(r)},{location:{...n,startLine:n.endLine,startColumn:n.endColumn-2}});case`FunctionConstruction`:if(g(e.bounds)){let i=m(e.bounds,t),a=r(e.body);return h(()=>Yr(i,a),n)}return A({kind:`Fcn`,bounds:p(e.bounds,t),body:r(e.body)},{location:n});case`FunctionSet`:return A({kind:`Arrow`,domain:r(e.domain),range:r(e.range)},{location:n});case`Record`:case`RecordSet`:return A({kind:e.kind===`Record`?`Record`:`Rect`,fields:e.fields.map(e=>({name:e.name,value:r(e.value)}))},{location:n});case`Except`:return A({kind:`Except`,function:r(e.function),specs:e.updates.map(e=>({trail:e.path.map(e=>e.kind===`Field`?{kind:`Dot`,field:e.name}:{kind:`Apply`,expression:e.args.length===1?r(e.args[0]):{kind:`Tuple`,elements:e.args.map(r)}}),value:_(e.value,!0)}))},{location:n});case`ExceptAt`:return A({kind:`At`,isExcept:t},{location:n});case`FunctionApplication`:return A({kind:`FcnApp`,function:r(e.function),args:e.args.map(r)},{location:n});case`FieldAccess`:return A({kind:`Dot`,expression:r(e.record),field:e.field},{location:n});case`Product`:return A({kind:`Product`,factors:e.factors.map(r)},{location:n});case`Always`:case`Eventually`:{let t=e.expression;return e.kind===`Always`&&t.kind===`BoxAction`?A({kind:`Tsub`,modal:`Box`,action:r(t.action),subscript:r(t.subscript)},{location:n}):e.kind===`Eventually`&&t.kind===`AngleAction`?A({kind:`Tsub`,modal:`Dia`,action:r(t.action),subscript:r(t.subscript)},{location:n}):a(e.kind===`Always`?`BoxTrue`:`Diamond`,r(t))}case`BoxAction`:case`AngleAction`:return A({kind:`Sub`,modal:e.kind===`BoxAction`?`Box`:`Dia`,action:r(e.action),subscript:r(e.subscript)},{location:n});case`WeakFairness`:case`StrongFairness`:return A({kind:`Fair`,fairness:e.kind===`WeakFairness`?`Weak`:`Strong`,subscript:r(e.subscript),action:r(e.action)},{location:n});case`Label`:return A({kind:`Parens`,expression:r(e.body),form:{kind:`Nlabel`,label:e.name,names:e.params}},{location:n});case`Subexpression`:{let[t,...i]=e.selectors;if(t.kind!==`Name`)throw new s(`Unexpected subexpression reference`);let a=A({kind:`Opaque`,name:t.name},{location:n}),o=t.args.length===0?a:A({kind:`Apply`,operator:a,args:t.args.map(r)},{location:n});return A({kind:`Bang`,expression:o,selectors:i.map(e=>{switch(e.kind){case`Name`:return{kind:`Label`,label:Q(e.name),args:e.args.map(r)};case`Operand`:return e.operand===`<<`?{kind:`Left`}:e.operand===`>>`?{kind:`Right`}:{kind:`Number`,value:e.operand};case`Bound`:return{kind:`Instance`,args:e.args.map(r)};case`At`:return{kind:`At`};case`Colon`:return{kind:`Down`}}})},{location:n})}}},v=e=>({location:a(e.definitionRange??e.instanceRange),args:e.params.map(e=>e.name),module:e.module,substitutions:e.substitutions.map(e=>({name:Q(e.name),expression:_(e.expression,!1)}))}),y=(e,t=!1)=>{let n=l(e.location);if(e.kind===`Instance`){if(e.name===void 0)throw new s(`Unexpected keyword INSTANCE`);return{kind:`Instance`,name:e.name,instance:v(e),location:n}}let r=Q(e.name,e.kind===`Operator`&&e.params.length===1&&e.name===`-`),i=_(e.body,t);if(e.kind===`Function`&&g(e.bounds)){let a=m(e.bounds,t);return{kind:`Operator`,name:r,body:h(()=>Yr(a,i),n),location:n}}if(e.kind===`Function`){let a=p(e.bounds,t);return{kind:`Operator`,name:r,body:A({kind:`Fcn`,bounds:a,body:i},{location:n}),location:n}}return e.params.length===0?{kind:`Operator`,name:r,body:i,location:n}:{kind:`Operator`,name:r,body:A({kind:`Lambda`,params:e.params.map(e=>({name:Q(e.name),shape:e.arity,...e.location&&{location:c(e.name,e.location)}})),body:i},{location:n}),location:n}},ee=e=>{let t=l(e.location);return e.level===`Variable`?{kind:`Flex`,name:e.name,location:t}:{kind:`Fresh`,name:e.name,shape:e.arity,level:e.level,domain:e.set&&_(e.set,!1),domainVisibility:`Visible`,location:t}},b=e=>e.kind===`AssumeProve`?{context:e.assumptions.map(e=>{if(e.kind===`NewSymbol`)return ee(e);if(e.kind===`AssumeProve`){let t=l(e.location);return{kind:`Fact`,expression:A({kind:`Sequent`,sequent:b(e)},{location:t}),visibility:`Visible`,location:t}}let t=x(e);return{kind:`Fact`,expression:t,visibility:`Visible`,location:t.location}}),active:_(e.conclusion,!1)}:{context:[],active:_(e,!1)},x=e=>{if(e.kind!==`Label`||e.params.length>0)return _(e,!1);let t=l(e.location);return A({kind:`Parens`,expression:_(e.body,!1),form:{kind:`Xlabel`,label:e.name,indices:[]}},{location:t})},S=e=>{if(e.kind===`ModuleFact`)throw new u(`MODULE facts in proof obligations are not supported`);let t=_(e,!1);return t.kind===`Bang`&&t.selectors.length===0?t.expression:t},C=e=>{let t=l(e.location);if(e.kind===`ModuleFact`)return{kind:`Dvar`,name:e.name,location:t};if(e.kind===`Identifier`)return{kind:`Dvar`,name:Q(e.name),location:t};if(e.kind===`OperatorReference`)return{kind:`Dvar`,name:Q(e.operator),location:t};throw new u(`This DEF clause in proof obligations is not supported`)},te=e=>({facts:e.facts.map(S),defs:e.defs.map(C)}),ne=(e,t)=>{let r=e?e[2]:``;return r===``?{kind:`Unnamed`,level:t,id:st(n)}:{kind:`Named`,level:t,label:r,isAnonymous:!1}},w=(e,t,n)=>{if(!e)return{kind:`Omitted`,omission:`Implicit`,location:n};switch(e.kind){case`Obvious`:return{kind:`Obvious`,location:o(a(e.keyword))};case`Omitted`:return{kind:`Omitted`,omission:`Explicit`,location:a(e.keyword)};case`By`:return{kind:`By`,usable:te(e),isOnly:e.isOnly,location:a(e.keyword),step:{kind:`Unnamed`,level:t,id:0}};case`Steps`:{let n=e.steps.map(e=>Zr.exec(e.token)),r=n[0],i=r&&r[1]!==`*`&&r[1]!==`+`?Number(r[1]):t,o=e.steps.slice(0,-1).map((e,t)=>E(e,ne(n[t],i),i)),s=e.steps[e.steps.length-1],c=ne(n[n.length-1],i),l=a(s.head),u=w(s.proof,i+1,l),d={proof:u,location:$(l,u.location),step:c};return{kind:`Steps`,steps:o,qed:d,location:o.reduce((e,t)=>$(e,t.location),d.location),step:d.step}}}},T=e=>$(a(e.keyword),e.defs.length>0?l(e.defs[e.defs.length-1].location):void 0),E=(e,t,n)=>{let r=a(e.head),i=e.body,o=i=>{let a=w(e.proof,n+1,r);return{...i(a),location:$(r,a.location),step:t}},c=e=>({...e,location:r,step:t});switch(i.kind){case`Use`:case`Hide`:{let n=$(a({...e.head,end:e.head.start}),T(i)),r=te(i);return i.kind===`Use`?{kind:`Use`,usable:r,isOnly:i.isOnly,location:n,step:t}:{kind:`Hide`,usable:r,location:n,step:t}}case`Instance`:throw new s(`Unexpected keyword INSTANCE`);case`Define`:return c({kind:`Define`,definitions:i.definitions.map(e=>y(e))});case`Have`:return c({kind:`Have`,expression:_(i.expression,!1)});case`Take`:return c({kind:`Take`,bounds:i.names.length>0?Rr(i.names):p(i.bounds,!1)});case`Witness`:return c({kind:`Witness`,expressions:i.expressions.map(e=>_(e,!1))});case`Pick`:{let e=i.names.length>0?Rr(i.names):p(i.bounds,!1),t=_(i.body,!1);return o(n=>({kind:`Pick`,bounds:e,expression:t,proof:n}))}case`Case`:{let e=_(i.expression,!1);return o(t=>({kind:`Pcase`,expression:e,proof:t}))}case`Assert`:{let e=b(i.statement);return o(t=>i.isSuffices?{kind:`Suffices`,sequent:e,proof:t}:{kind:`Assert`,sequent:e,proof:t})}case`Qed`:throw new u(`QED in the middle of a proof`)}},re=e=>({name:e.name,extendees:e.extends,extendeeLocations:e.extendsRanges.map(a),isImportant:!1,location:l(e.location),body:e.units.map(e=>{switch(e.kind){case`Constants`:case`Recursive`:return{kind:e.kind===`Constants`?`Constants`:`Recursives`,declarations:e.declarations.map(e=>({name:Q(e.name),shape:e.arity})),location:l(e.declarations[0].location)};case`Variables`:return{kind:`Variables`,names:e.declarations.map(e=>e.name),location:l(e.declarations[0].location)};case`Definition`:return{kind:`Definition`,definition:y(e.definition),whereDefined:`User`,visibility:`Hidden`,isLocal:e.definition.isLocal,location:l(e.definition.location)};case`Instance`:{let t=e.instance,n=l(t.location);return t.name===void 0?{kind:`Anoninst`,instance:v(t),isLocal:t.isLocal,location:n}:{kind:`Definition`,definition:y(t),whereDefined:`User`,visibility:`Hidden`,isLocal:t.isLocal,location:a(t.instanceRange)}}case`Assumption`:return{kind:`Axiom`,name:e.assumption.name,expression:_(e.assumption.expression,!1),location:l(e.assumption.location)};case`Theorem`:{let t=e.theorem,n=l(t.location),r=o(n);return{kind:`Theorem`,name:t.name,sequent:b(t.statement),axiomCount:0,proof:w(t.proof,0,{...r,startLine:r.endLine,startColumn:r.endColumn}),location:n}}case`Use`:return{kind:`Mutate`,mode:e.use.kind,isSuppressed:!1,usable:te(e.use),location:T(e.use)};case`Module`:return{kind:`Submod`,module:{...re(e.module),isImportant:!0}}}})});return{convertModule:re}},ci={start:0,end:1/0},li=/-{4,} *MODULE/,ui=`Unexpected EOF`,di=e=>e?`${e.startLine}:${e.startColumn}:${e.endLine}:${e.endColumn}`:``,fi=e=>{let t=l(e),n=e.split(`
+`),r=t.at(-1)?.line??n.length,i=n.slice(0,r-1).reduce((e,t)=>e+t.length+1,0)+n[r-1].indexOf(`====`),a=e.indexOf(`	`,e.search(li));if(a===-1||a>=i)return;let o=e.slice(0,a).split(`
+`).length,s=a-e.lastIndexOf(`
+`,a-1),c=t.findLast(e=>e.kind!==`End`&&(e.line<o||e.line===o&&e.column<s));return{offset:a,line:o,column:s,end:{reason:ui,line:c?.line??o,column:c?c.endColumn+1:s,isEnd:!0}}},pi=e=>{try{return e()}catch(e){if(!(e instanceof c)||!e.failure)throw e;return e.failure}},mi=e=>typeof e==`object`&&!!e&&`reason`in e,hi=e=>{let t=pi(()=>fi(e));if(mi(t))return[t];let n=pi(()=>_(t?e.slice(0,t.offset):e));return t&&(!mi(n)||n.isEnd)?[{reason:`Unexpected TAB character. TLAPS does not handle TAB characters in source files.`,line:t.line,column:t.column,isEnd:!1},mi(n)&&n.reason===ui?n:t.end]:mi(n)?[n]:n},gi=(e,t,n,r,i)=>{if(!li.test(e.source))throw new s(`No tokens in file`);let a=hi(e.source);if(Array.isArray(a)){a.forEach(t=>{let n=`File ${JSON.stringify(e.file)}, line ${t.line}, character ${t.column}\n${t.reason}`;r({text:n,channel:`stderr`}),r({text:`${n}\n`,channel:`toolboxOnly`})});let t=`Could not parse ${JSON.stringify(e.file)} successfully.`;throw r({text:`${i}Error: ${t}`,channel:`stderr`}),new s(t,{failure:`Module.Parser.parse_file`})}let o=si(e.file,e.source,t,n).convertModule(a),c=e.file.slice(e.file.lastIndexOf(`/`)+1),l=c.replace(/\.tla$/,``);return o.name===l?o:(r({text:`${de(o.location)}Warning: module name ${JSON.stringify(o.name)} does not match file name ${JSON.stringify(c)}.`,channel:`toolbox`}),{...o,name:l})},_i=e=>{let t=new Map([...e].map(([e,t])=>[e,hr(t).dependencies])),n=/* @__PURE__ */ new Set,r=[],i=a=>{if(n.has(a))return;n.add(a);let o=e.get(a);if(!o)throw new s(`Module "${a}" not found`);(t.get(a)??[]).forEach(i),r.push(o)};return[...e.keys()].sort(_r).forEach(i),r},vi=(e,t,n)=>t.length===0?[]:[`    ${e}_proofs_count = ${t.length}`,...t.map((t,r)=>`    ${e}_proof_${n+r+1} at ${ce(t)}`)],yi=(e,t,n)=>{let r=e.location;return[`  ---- incomplete proof of theorem at ${r?ce({...r,endLine:r.startLine,endColumn:r.startColumn}):`<unknown location>`} ----`,...vi(`missing`,e.absent,t),...vi(`omitted`,e.omitted,n),`  ====`]},bi=e=>{let t=e.summary,n=t.theorems.reduce((e,t)=>t.absent.length+t.omitted.length===0?e:{lines:[...e.lines,...yi(t,e.missing,e.omitted)],missing:e.missing+t.absent.length,omitted:e.omitted+t.omitted.length},{lines:[],missing:0,omitted:0});return[`---- summary of module ${JSON.stringify(e.name)} ----`,`  obligations_count = ${t.total}`,...t.absent.length>0?[`  missing_proofs_count = ${t.absent.length}`]:[],...t.omitted.length>0?[`  omitted_proofs_count = ${t.omitted.length}`]:[],...n.lines,`====`].join(`
+`)},xi=(e,t,n={})=>{let r=n.lines??ci,i=n.onWarning??(()=>{}),a={value:0},o=new Map(lr);e.forEach(e=>{let t={...gi(e,a,!0,i,`File "<unknown>":
+`),isImportant:!0};o.set(t.name,t)});let c=[...o.values()].sort((e,t)=>_r(e.name,t.name)),l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Set;for(let e=0;e<c.length;e++){let n=hr(c[e]);n.submodules.forEach((e,t)=>{u.add(t),o.has(t)||o.set(t,e)});for(let e of n.dependencies){if(o.has(e)&&!lr.has(e))continue;let r=t(e);if(!r){!o.has(e)&&!l.has(e)&&l.set(e,n.locations.get(e));continue}let s=gi(r,a,!1,i,ue(n.locations.get(e)));o.set(e,s),c.push(s)}}let d=[...l.keys()].filter(e=>!u.has(e)).sort(_r);if(d.forEach(e=>i(D(l.get(e),`Unknown module ${JSON.stringify(e)}`))),d.length>0)throw new s(`Unknown module ${JSON.stringify(d[0])}`,{failure:`Module.Parser.load_module`});let f={anonymizer:dt(a,(e,t)=>Mr(f,e,t),i),generator:jn(a,new Set(e.map(e=>e.file)),r,i),salts:{value:0},latestModules:/* @__PURE__ */ new Map,onWarning:i},p=_i(o).map(e=>e.isStandard?e:mr(o,e,/* @__PURE__ */ new Set)),m=new Map(p.map(e=>[e.name,e]));return p.flatMap(e=>{if(e.isStandard)return[];let t=Nr(f,m,void 0,e);if(!e.isImportant)return[];let n=Pr(f,[],t),i=n.obligations.flatMap((e,t)=>{let n=e.location;if(e.kind.kind===`Omitted`||n&&(n.startLine<r.start||n.endLine>r.end))return[];let i=e.kind.kind===`Error`?e.kind.message:`${sn(e.sequent)}\n`;return[{id:t+1,location:di(n),text:i}]});return[{name:e.name,location:e.location,obligations:i,summary:n.summary}]})},Si={success:o.success,"assumption-violation":o.assumptionViolation,deadlock:o.deadlock,"invariant-violation":o.safetyViolation,"property-violation":o.safetyViolation,"liveness-violation":o.livenessViolation,"postcondition-violation":o.assumptionViolation,error:o.error},Ci=se(`tla-ts <Spec.tla|Spec.cfg|glob>... {options}`,[{flag:`-config <Spec.cfg>`},{flag:`-deadlock`},{flag:`-lncheck <final|default>`},{flag:`-seed <num>`},{flag:`-workers <count|auto>`}]),wi=se(`tla-ts prove {options} <Module.tla|glob>...`,[{flag:`-N`,isRequired:!0},{flag:`--toolbox <start> <end>`},{flag:`--line <num>`},{flag:`--printallobs`},{flag:`--summary`},{flag:`--strict`},{flag:`-I <directory>`,isRepeatable:!0}]),Ti=[`Usage: ${Ci.usage}`,`       ${wi.usage}`,`       tla-ts prove [<tlapm option>]... <Module.tla|glob>...`].join(`
+`),Ei=/[*?[{]/,Di=e=>e.flatMap(e=>Ei.test(e)?ee(e).sort().map(e=>({path:e,isGlobbed:!0})):[{path:e,isGlobbed:!1}]),Oi=e=>/^[+-]?\d+$/.test(e)&&BigInt.asIntN(64,BigInt(e))===BigInt(e),ki=e=>e?e[0]===`auto`?ae():Math.max(1,Number.parseInt(e[0],10)||1):1,Ai=e=>{let n=Object.entries(e);n.forEach(([e,i])=>console.log(`${n.length===1?``:`/\\ `}${e} = ${r(t(i))}`)),console.log(``)},ji=(e,t=`Error: The behavior up to this point is:`)=>{e.length>0&&console.log(t),e.forEach((e,t)=>{console.log(`State ${t+1}: <${e.label??e.action??`Initial predicate`}>`),Ai(e.state)})},Mi=e=>{if(e.failure)console.log(`Error: ${e.failure.message}`),e.failure.initialState&&(console.log(`While working on the initial state:`),Ai(e.failure.initialState)),ji(e.failure.trace);else if(e.violation){let t=e.violation,n=t.name,r=t.loopStart,i=r===void 0&&t.trace.length===1&&(e.status===`invariant-violation`||e.status===`liveness-violation`),a={success:``,error:``,"assumption-violation":t.message?`Error: Evaluating assumption ${n} failed.\n${t.message}`:`Error: Assumption ${n} is false.`,deadlock:`Error: Deadlock reached.`,"invariant-violation":i?`Error: Invariant ${n} is violated by the initial state:`:`Error: Invariant ${n} is violated.`,"property-violation":`Error: Property ${n} is violated.`,"liveness-violation":r===void 0?i?`Error: Property ${n} is violated by the initial state:`:`Error: Action property ${n} is violated.`:`Error: Temporal property ${n} was violated.\n`,"postcondition-violation":`Error: ${t.message??`Postcondition ${n} is false.`}`}[e.status];if(t.counts&&console.log(t.counts),console.log(a),i)Ai(t.trace[0].state);else if(r===void 0)ji(t.trace);else{ji(t.trace,`Error: The following behavior constitutes a counter-example:
+`);let e=r===t.trace.length-1;console.log(e?`State ${r+2}: Stuttering`:`Back to state ${r+1}${t.loopLabel?`: <${t.loopLabel}>\n`:``}`)}let o=t.unwitnessed;if(o?.counts&&console.log(o.counts),o&&console.log(`Error: ${o.message}`),i||e.status===`assumption-violation`)return}else{let t=d(e.distinctStates,e.generatedStates);if(console.log(`Model checking completed. No error has been found.`),console.log(`  Estimates of the probability that TLC did not check all reachable states`),console.log(`  because two distinct states had the same fingerprint:`),console.log(`  calculated (optimistic):  val = ${m(t)}`),e.fingerprintDistance!==void 0){let t=g(e.fingerprintDistance);console.log(`  based on the actual fingerprints:  val = ${m(t)}`)}}console.log(`${e.generatedStates} states generated, ${e.distinctStates} distinct states found, ${e.queuedStates} states left on queue.`),console.log(`The depth of the complete state graph search is ${e.depth}.`);let t=e.outDegrees&&h(e.outDegrees);t&&console.log(t)},Ni=async(e,t)=>{if(!y(e))return console.error(`Cannot find the specification file ${e}`),o.configParseError;let r=t.get(`-config`)?.[0]??(t.has(`-config`)?void 0:e.replace(/\.tla$/,`.cfg`));if(!r||!y(r))return console.error(`Cannot find the configuration file ${r??``}`),o.configParseError;let i=n(x(r,`utf8`));t.has(`-deadlock`)&&(i.checkDeadlock=!1);let a=t.has(`-seed`)?t.get(`-seed`)?.[0]:`0`;if(a===void 0)return console.error(`Error: seed required.`),1;if(!Oi(a))return console.error(`Error: An integer for seed required. But encountered ${a}`),1;let s=t.has(`-lncheck`)?t.get(`-lncheck`)?.[0]?.toLowerCase():`default`;if(s===void 0)return console.error(`Error: expect a strategy such as final for -lncheck option.`),1;let c=E(e);console.log(`Checking ${w(e)} with ${w(r)}`);let l=await v({workers:ki(t.get(`-workers`)),livenessCheck:[`final`,`seqfinal`,`off`].includes(s)?`final`:`default`,seed:BigInt(a),source:x(e,`utf8`),config:i,onPause:()=>S(0,Buffer.alloc(1)),loadModule:e=>{let t=re(c,`${e}.tla`);return y(t)?x(t,`utf8`):void 0},loadClass:e=>{let t=re(c,`${e}.class`);return y(t)?x(t):void 0},readFile:e=>y(e)?x(e,`utf8`):void 0,writeFile:(e,t)=>{b(E(ie(e)),{recursive:!0}),te(e,t)}});return Mi(l),l.failure?.exitCode??Si[l.status]},Pi=e=>{if(e instanceof p||e instanceof f)return console.log(`Error: ${e.message}`);console.error(`${e.name}: ${e.message}`)},Fi=async t=>{try{return await t()}catch(t){if(!(t instanceof e))throw t;return Pi(t),a(t)}},Ii=async(e,t)=>{let n=[];for(let[r,i]of e.entries())r>0&&console.log(``),n.push(await Fi(()=>t(i)));return n.find(e=>e!==o.success)??o.success},Li=()=>(process.env.PATH??``).split(T).map(e=>re(e,`tlapm`)).filter(e=>y(e)),Ri=()=>Li().map(e=>re(E(E(C(e))),`lib/tlapm/stdlib`)).find(e=>y(e)),zi=e=>e.flatMap(e=>Ei.test(e)?ee(e).sort():[e]),Bi=e=>{let t=Li()[0];return t===void 0?(console.error(`Error: tla-ts prove runs tlapm to prove obligations, but tlapm isn't on your PATH. Install tlapm, or pass -N to only generate the obligations.`),1):ne(t,zi(e),{stdio:`inherit`}).status??1},Vi=e=>y(e)?{file:e,source:x(e,`utf8`)}:void 0,Hi=e=>console.error(`@!!BEGIN\n${e.map(e=>`@!!${e}\n`).join(``)}@!!END\n`),Ui=e=>/^[+,\-./0-9:=@A-Z_a-z]+$/.test(e)?e:`'${e.replaceAll(`'`,`'\\''`)}'`,Wi=e=>{let t=/* @__PURE__ */ new Date,n=e=>String(e).padStart(2,`0`),r=`${t.getFullYear()}-${n(t.getMonth()+1)}-${n(t.getDate())}`,i=`${n(t.getHours())}:${n(t.getMinutes())}:${n(t.getSeconds())}`;console.log(`\n\\* TLAPM version 5f5037f\n\\* launched at ${r} ${i} with command line:\n\\* ${[`tla-ts`,`prove`,...e].map(Ui).join(` `)}\n`)},Gi={incomplete:11,emptyTarget:12},Ki=(e,t,n)=>{let r=e.summary;n||(r.absent.forEach(e=>console.error(`Missing proof at ${le(e)}`)),r.omitted.forEach(e=>console.error(`Omitted proof at ${le(e)}`)));let i=r.absent.length+r.omitted.length>0;i&&console.error(`${ue(e.location)}[ERROR]: Proof incomplete in module ${JSON.stringify(e.name)}: ${r.absent.length} missing, ${r.omitted.length} omitted proof step(s).`);let a=t&&e.obligations.length===0;return a&&console.error(`${ue(e.location)}[ERROR]: No proof obligation found for the selected target.`),[...i?[Gi.incomplete]:[],...a?[Gi.emptyTarget]:[]]},qi=e=>{try{return e()}catch(e){if(!(e instanceof s))throw e;console.error(` tlapm ending abnormally with ${e.exception}\n`);return}},Ji=e=>{if(!e.includes(`-N`)&&!e.includes(`--summary`))return Bi(e);let t=wi.parse(e),n=t.unknown[0];if(n!==void 0)return console.error(`Error: tla-ts prove does not support the tlapm option ${n}.`),1;if(t.incomplete)return console.error(`Error: option '${t.incomplete.name}' needs an argument.`),1;let r=t.options.find(e=>e.name!==`-I`&&e.values.some(e=>!/^-?\d+$/.test(e)));if(r)return console.error(`Error: option '${r.name}' expects an integer.`),1;let i=zi(t.positionals),a=i.map(e=>e.endsWith(`.tla`)?e:`${e}.tla`);if(a.length===0)return console.error(Ti),1;let c=t.has(`--toolbox`)||t.has(`--line`);c&&Wi(e);let l=t.options.reduce((e,t)=>{let[n,r]=t.values.map(Number);return t.name===`--toolbox`?{start:n,end:r===0?1/0:r}:t.name===`--line`?n===0?ci:{start:n,end:n}:e},ci),u=Ri(),d=t.options.flatMap(e=>e.name===`-I`?e.values:[]),f=a.reduce((e,t)=>e.includes(E(t))?e:[E(t),...e],[`.`,...u?[u]:[],...d.toReversed()]),p=qi(()=>{let e=a.findIndex(e=>!y(e));if(e!==-1){let t=i[e];throw console.error(`File "<unknown>":\nError: File ${JSON.stringify(t)} not found`),new s(`File ${t} not found`,{failure:`Module.Parser.parse_file`})}return xi(a.map(e=>({file:`./${e}`,source:x(e,`utf8`)})),e=>f.map(t=>Vi(`${t}/${e}.tla`)).find(Boolean),{lines:l,onWarning:e=>{if(e.channel===`stdout`)return console.log(e.text);let t=e.channel===`toolbox`||e.channel===`toolboxOnly`;if(c&&t)return Hi([`type:warning`,`msg:${e.text}`]);e.channel!==`toolboxOnly`&&console.error(e.text)}})});if(!p)return 3;let m=p.flatMap(e=>(t.has(`--summary`)&&console.log(bi(e)),c&&(e.obligations.forEach(e=>Hi([`type:obligation`,`id:${e.id}`,`loc:${e.location}`,`status:to be proved`,...t.has(`--printallobs`)?[`obl:${e.text}`]:[]])),Hi([`type:obligationsnumber`,`count:${e.obligations.length}`])),t.has(`--strict`)?Ki(e,l.start>0||l.end<1/0,t.has(`--summary`)):[]));return m.includes(Gi.incomplete)?Gi.incomplete:m[0]??o.success},Yi=async e=>{if(e[0]===`prove`)return Fi(()=>Ji(e.slice(1)));let t=Ci.parse(e),n=Di(t.positionals),r=t.has(`-config`),i=n.map(e=>({...e,path:e.path.replace(/\.cfg$/,`.tla`)})).filter(e=>e.path.endsWith(`.tla`)&&(!e.isGlobbed||r||y(e.path.replace(/\.tla$/,`.cfg`)))).map(e=>e.path);return i.length===0?(console.error(Ti),1):r&&i.length>1?(console.error(`Error: -config applies to one specification, but several were given.`),1):Ii([...new Set(i)],e=>Ni(e,t))},Xi=async()=>{process.exitCode=await Yi(process.argv.slice(2))};export{Xi as runCli};