proof.pbenum library Null safety