interface:
  display_name: "Contract Driven"
  short_description: "Use when crossing a public API boundary, guarding complex invariants, or hardening untrusted input or integration seams."

# Contract patterns by language

These brief annotation patterns show a precondition, postcondition, and invariant for each language.

## Python

```python
@deal.inv(lambda self: self.balance >= 0)
class Account:
    @deal.pre(lambda self, amount: amount > 0)
    @deal.pre(lambda self, amount: amount <= self.balance)
    @deal.ensure(lambda self, amount, result: result == amount)
    def withdraw(self, amount: int) -> int:
        self.balance -= amount
        return amount
```

## Rust

```rust
pub fn withdraw(&mut self, amount: u64) -> Result<u64, Error> {
    assert!(amount > 0, "PRE: amount must be positive");
    assert!(amount <= self.balance, "PRE: insufficient funds");
    let old_balance = self.balance;
    self.balance -= amount;
    debug_assert!(self.balance == old_balance - amount, "POST: balance delta");
    debug_assert!(self.balance >= 0, "INV: non-negative balance");
    Ok(amount)
}
```

## TypeScript

```typescript
const WithdrawInput = z.object({
  amount: z.number().positive().max(MAX_BALANCE),
});

function withdraw(account: Account, input: z.infer<typeof WithdrawInput>): number {
  invariant(input.amount <= account.balance, 'PRE: insufficient funds');
  const oldBalance = account.balance;
  account.balance -= input.amount;
  invariant(account.balance === oldBalance - input.amount, 'POST: balance delta');
  return input.amount;
}
```

## Kotlin

```kotlin
fun withdraw(amount: Int): Int {
    require(amount > 0) { "PRE: amount must be positive" }
    require(amount <= balance) { "PRE: insufficient funds" }
    val oldBalance = balance
    balance -= amount
    check(balance == oldBalance - amount) { "POST: balance delta" }
    check(balance >= 0) { "INV: non-negative balance" }
    return amount
}
```

## Java

```java
public int withdraw(int amount) {
    Preconditions.checkArgument(amount > 0, "PRE: positive amount");
    Preconditions.checkArgument(amount <= balance, "PRE: insufficient funds");
    int oldBalance = balance;
    balance -= amount;
    Verify.verify(balance == oldBalance - amount, "POST: balance delta");
    return amount;
}
```

## C#

```csharp
public int Withdraw(int amount) {
    Guard.Against.NegativeOrZero(amount, nameof(amount));
    Guard.Against.OutOfRange(amount, nameof(amount), 0, Balance);
    var oldBalance = Balance;
    Balance -= amount;
    Debug.Assert(Balance == oldBalance - amount, "POST: balance delta");
    return amount;
}
```

## Go

```go
func (a *Account) Withdraw(amount int) (int, error) {
    if amount <= 0 { return 0, fmt.Errorf("PRE: amount must be positive") }
    if amount > a.balance { return 0, fmt.Errorf("PRE: insufficient funds") }
    oldBalance := a.balance
    a.balance -= amount
    if a.balance != oldBalance-amount { panic("POST: balance delta violated") }
    return amount, nil
}
```

## C++

```cpp
int Account::withdraw(int amount) {
    Expects(amount > 0);           // GSL precondition
    Expects(amount <= balance_);
    auto old = balance_;
    balance_ -= amount;
    Ensures(balance_ == old - amount);  // GSL postcondition
    return amount;
}
```

## Swift

```swift
func withdraw(_ amount: Int) -> Int {
    precondition(amount > 0, "PRE: positive amount")
    precondition(amount <= balance, "PRE: insufficient funds")
    let oldBalance = balance
    balance -= amount
    assert(balance == oldBalance - amount, "POST: balance delta")
    return amount
}
```

## Scala

```scala
def withdraw(amount: Int): Int = {
  require(amount > 0, "PRE: positive amount")
  require(amount <= balance, "PRE: insufficient funds")
  val oldBalance = balance
  balance -= amount
  assert(balance == oldBalance - amount, "POST: balance delta")
  assert(balance >= 0, "INV: non-negative balance")
  amount
}
```

# Contract libraries by language

**Grounded: 2026-08-31**

| Language | Library/Approach | Style |
|----------|-----------------|-------|
| Python | deal / beartype (O(1) runtime) | @deal.pre, @deal.post, validator annotations |
| Rust | assert! + debug_assert! + newtypes | type-driven contracts |
| TypeScript | Zod v4 + invariant / Effect-TS | z.refine(), invariant() |
| Kotlin | Native | require(), check(), contract {} |
| Java | Guava Preconditions / Bean Validation | checkArgument(), @Valid |
| C# | FluentValidation / Guard clauses | Guard.Against.*() |
| Go | Explicit checks + fmt.Errorf | convention-based |
| C++ | GSL Expects/Ensures | Expects(x > 0) |
| Swift | precondition() / guard | precondition(x > 0) |
| Scala | require() / ensuring() | require(x > 0) |

## Notes

- C++26 contracts (P2900R14, Feb 2025): Standardizing `[[pre]]`, `[[post]]`, `[[assert]]` with enforce/observe/quick-enforce/ignore semantics. GSL remains the bridge until compiler adoption.
- Zod v4 (Aug 2025): the current line is 4.4.x. 14x faster parsing, z.templateLiteral(), @zod/mini for lightweight validation. Primary choice for TypeScript boundary contracts.
- beartype (Python): O(1) runtime type checking via random sampling. Complements deal for performance-sensitive code.
- Effect-TS: Provides branded types + Schema validation as an alternative to Zod for TypeScript contract enforcement.
- Kotlin: `contract {}` provides compiler hints (smart casts after checks). `require()` = preconditions, `check()` = invariants.