invariants scala type-safety