@demlik/tea 0.1.0 → 0.1.1

package/dist/chunk-2WZHS4P2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["state","opts"],"mappings":";;;AAiGO,SAAS,OAAO,CAAA,EAAiB;AACtC,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,KAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,CAAA;AACrD;AAgBO,IAAM,OAAO,CAClB,KAAA,EACA,SAC+B,CAAC,KAAA,EAAO,EAAE;AAK3C,IAAM,gBAAA,uBAAuB,GAAA,EAAY;AASlC,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAC9B,IAAA,GAAO,wBAAA;AAAA,EACzB,YAAY,QAAA,EAAkB;AAC5B,IAAA,KAAA;AAAA,MACE,6BAA6B,QAAQ,CAAA,+IAAA;AAAA,KAGvC;AAAA,EACF;AACF;AAUO,SAAS,mBAAA,GAA4B;AAC1C,EAAA,gBAAA,CAAiB,KAAA,EAAM;AACzB;AAsDA,SAAS,cAAA,CAAe,OAAgB,QAAA,EAAqC;AAC3E,EAAA,UAAA,CAAW,MAAM;AACf,IAAA,MAAM,KAAA;AAAA,EACR,GAAG,CAAC,CAAA;AACN;AA2FA,SAAS,qBACP,WAAA,EAC6B;AAC7B,EAAA,IAAI,WAAA,KAAgB,MAAA,EAAW,OAAO,EAAE,UAAU,MAAA,EAAO;AACzD,EAAA,IAAI,OAAO,WAAA,KAAgB,QAAA,EAAU,OAAO,EAAE,UAAU,WAAA,EAAY;AACpE,EAAA,OAAO,WAAA;AACT;AAYO,IAAM,sBAAA,GAAN,cAAqC,KAAA,CAAM;AAAA,EAEhD,YAA4B,UAAA,EAAoB;AAC9C,IAAA,KAAA;AAAA,MACE,sDAAsD,UAAU,CAAA,yOAAA;AAAA,KAKlE;AAP0B,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAQ5B;AAAA,EATkB,IAAA,GAAO,wBAAA;AAU3B;AAgBO,SAAS,WAAc,IAAA,EAAuB;AASnD,EAAA,IAAI,KAAA,GAAQ,KAAA;AACZ,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,MAAA,CAAA,IAAA;AACb,IAAA,KAAA,GAAQ,IAAA,EAAM,GAAA,KAAQ,KAAA,CAAA,IAAa,IAAA,EAAM,GAAA,KAAQ,IAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,KAAA,GAAQ,KAAA;AAAA,EACV;AACA,EAAA,IAAI,CAAC,KAAA,IAAS,gBAAA,CAAiB,GAAA,CAAI,IAAI,CAAA,EAAG;AACxC,IAAA,MAAM,IAAI,uBAAuB,IAAI,CAAA;AAAA,EACvC;AACA,EAAA,gBAAA,CAAiB,IAAI,IAAI,CAAA;AACzB,EAAA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,IAAA,EAAK;AACjC;AA6ZO,SAAS,cAMd,CAAA,EAAuD;AAMvD,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAA,CAAO,cAAA,CAAe,GAAG,QAAA,EAAU;AAAA,MACjC,KAAA,EAAO,gBAAA,CAAiB,CAAA,CAAE,MAAgB,CAAA;AAAA,MAC1C,UAAA,EAAY,KAAA;AAAA,MACZ,QAAA,EAAU,KAAA;AAAA,MACV,YAAA,EAAc;AAAA,KACf,CAAA;AAAA,EACH;AACA,EAAA,OAAO,CAAA;AACT;AAkBO,SAAS,UACd,OAAA,EAC2B;AAC3B,EAAA,OAAO,OAAA;AACT;AAuCO,SAAS,GAAA,CAQd,SACA,IAAA,EAgDyB;AACzB,EAAA,MAAM,EAAE,OAAM,GAAI,IAAA;AAMlB,EAAA,MAAM,GAAA,GAAO,IAAA,CAAK,GAAA,IAAO,EAAC;AAC1B,EAAA,MAAM,OAAA,GAAU,KAAK,SAAA,IAAa,GAAA;AAIlC,EAAA,MAAM,aAAA,GACJ,IAAA,CAAK,MAAA,KAAW,MAAM,EAAC,CAAA;AAIzB,EAAA,MAAM,UAAA,GAAoC,IAAA,CAAK,QAAA,KAAa,MAAM,KAAA,CAAA;AAKlE,EAAA,MAAM,OAAA,GAAmB,KAAK,OAAA,IAAW,cAAA;AAIzC,EAAA,MAAM,WAAA,GAAc,CAAC,KAAA,EAAgB,OAAA,KAAuC;AAC1E,IAAA,IAAI;AACF,MAAA,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IACxB,SAAS,SAAA,EAAW;AAClB,MAAA,cAAA,CAAe,SAAkB,CAAA;AAAA,IACnC;AAAA,EACF,CAAA;AAIA,EAAA,MAAM,WAAA,GAAc,oBAAA,CAA2B,IAAA,CAAK,WAAW,CAAA;AAI/D,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI,SAAA,GAAqB,IAAA;AACzB,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAChD,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgB;AAKtC,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAAgC;AAKtD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAwB;AACjD,EAAA,IAAI,MAAA,GAAS,KAAA;AAOb,EAAA,MAAM,aAAA,uBAAoB,GAAA,EAAqC;AAM/D,EAAA,MAAM,WAAA,uBAAkB,GAAA,EAAwB;AAQhD,EAAA,MAAM,YAAA,uBAAmB,GAAA,EAAkD;AAK3E,EAAA,SAAS,QAAA,CAAY,MAAe,KAAA,EAAgB;AAClD,IAAA,MAAM,WAAA,GAAc,YAAA,CAAa,GAAA,CAAI,IAAqB,CAAA;AAC1D,IAAA,IAAI,CAAC,WAAA,IAAe,WAAA,CAAY,IAAA,KAAS,CAAA,EAAG;AAC5C,IAAA,KAAA,MAAW,YAAY,WAAA,EAAa;AAClC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,CAAA;AAAA,MAChB,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAKA,EAAA,MAAM,YAAA,GAAkC,EAAE,GAAG,GAAA,EAAK,MAAM,QAAA,EAAS;AAwBjE,EAAA,MAAM,aAAa,OAAA,CAAQ,MAAA;AAK3B,EAAA,MAAM,UAAA,GAAyB,OAAO,OAAO,CAAA;AAC7C,EAAA,SAAS,WAAA,CAAYA,QAAU,GAAA,EAAoC;AACjE,IAAA,IAAI,OAAA,aAAoBA,MAAK,CAAA;AAE7B,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,eAAe,SAAA,EAAW;AAI5B,MAAA,MAAM,MAAA,GAAS,UAAA;AACf,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,GAAA,CAAI,IAAiB,CAAA;AAC5C,MAAA,MAAA,GAAS,OAAA,CAAQA,QAAO,GAAsC,CAAA;AAAA,IAChE,CAAA,MAAO;AAKL,MAAA,MAAM,KAAA,GAAQ,UAAA;AACd,MAAA,MAAM,WAAYA,MAAAA,CAAsC,IAAA;AAIxD,MAAA,MAAM,OAAA,GAAU,KAAA,CAAM,QAAQ,CAAA,CAAG,IAAI,IAAI,CAAA;AACzC,MAAA,MAAA,GAAS,OAAA,CAAQA,QAAO,GAAG,CAAA;AAAA,IAC7B;AAEA,IAAA,IAAI,OAAA,EAAS,gBAAA,CAAiB,MAAA,EAAQ,GAAA,CAAI,IAAI,CAAA;AAC9C,IAAA,OAAO,MAAA;AAAA,EACT;AAMA,EAAA,IAAI,IAAA,GAAsB,QAAQ,OAAA,EAAQ;AAW1C,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,IAAI,CAAC,QAAQ,aAAA,EAAe;AAC5B,IAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,aAAA,CAAc,KAAU,CAAA;AAChD,IAAA,MAAM,UAAA,uBAAiB,GAAA,EAAY;AASnC,IAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAChD,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA;AAC3C,MAAA,IAAI,QAAA,KAAa,MAAA,IAAa,QAAA,KAAa,GAAA,CAAI,IAAA,EAAM;AACnD,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,sCAAsC,GAAA,CAAI,EAAE,uBAAuB,QAAQ,CAAA,YAAA,EAAe,IAAI,IAAI,CAAA,CAAA;AAAA,SACpG;AAAA,MACF;AACA,MAAA,eAAA,CAAgB,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,GAAA,CAAI,IAAI,CAAA;AAAA,IACtC;AAGA,IAAA,KAAA,MAAW,GAAA,IAAO,OAAA,EAAS,UAAA,CAAW,GAAA,CAAI,IAAI,EAAE,CAAA;AAChD,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,EAAE,CAAA,EAAG;AACvB,QAAA,IAAI;AACF,UAAA,OAAA,EAAQ;AAAA,QACV,SAAS,GAAA,EAAK;AACZ,UAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,QACnB;AACA,QAAA,WAAA,CAAY,OAAO,EAAE,CAAA;AAAA,MACvB;AAAA,IACF;AAGA,IAAA,IAAI,eAAA,GAA2B,IAAA;AAC/B,IAAA,KAAA,MAAW,OAAO,OAAA,EAAS;AACzB,MAAA,IAAI,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAE,CAAA,EAAG;AAC7B,MAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,SAAA,GAAY,GAAA,CAAI,IAAiB,CAAA;AACzD,MAAA,IAAI,CAAC,OAAA,EAAS;AAIZ,QAAA;AAAA,MACF;AACA,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,OAAA;AAAA,UACd,GAAA;AAAA,UACA,GAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,WAAA,CAAY,GAAA,CAAI,GAAA,CAAI,EAAA,EAAI,OAAO,CAAA;AAAA,MACjC,SAAS,GAAA,EAAK;AACZ,QAAA,IAAI,eAAA,KAAoB,MAAM,eAAA,GAAkB,GAAA;AAAA,MAElD;AAAA,IACF;AACA,IAAA,IAAI,eAAA,KAAoB,MAAM,MAAM,eAAA;AAAA,EACtC;AAgBA,EAAA,MAAM,YAAA,GACH,OAAA,CAAyC,SAAA,IAAc,EAAC;AAU3D,EAAA,eAAe,aAAa,IAAA,EAAmC;AAC7D,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,MAAM,OAAA,GAAU,YAAA,CAAa,GAAA,CAAI,IAAiB,CAAA;AAClD,MAAA,IAAI,CAAC,OAAA,EAAS;AACd,MAAA,MAAM,SAAS,MAAM,OAAA;AAAA,QACnB,GAAA;AAAA,QACA;AAAA,OACF;AACA,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,KAAW,IAAA,EAAM;AAQ3C,QAAA,eAAA,CAAgB,MAAW,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AACrD,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C,CAAC,CAAA;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAQA,EAAA,SAAS,aAAA,GAAsB;AAC7B,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,IAAI;AACF,QAAA,QAAA,EAAS;AAAA,MACX,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AASA,EAAA,SAAS,cAAc,GAAA,EAAc;AACnC,IAAA,IAAI,SAAA,CAAU,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACjD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,KAAA,MAAW,YAAY,SAAA,EAAW;AAChC,MAAA,IAAI;AACF,QAAA,QAAA,CAAS,KAAK,QAAQ,CAAA;AAAA,MACxB,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAUA,EAAA,SAAS,WAAW,GAAA,EAAc;AAChC,IAAA,IAAI,aAAA,CAAc,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACrD,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,aAAA,CAAc,KAAK,KAAK,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AACjB,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,MAAA,MAAM,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3C,MAAA,IAAI,WAAW,MAAA,EAAW;AAC1B,MAAA,KAAA,MAAW,WAAW,MAAA,EAAQ;AAC5B,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,SAAS,GAAA,EAAK;AACZ,UAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,QACnB;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAQA,EAAA,SAAS,QAAA,GAAiB;AACxB,IAAA,MAAA,GAAS,IAAA;AACT,IAAA,IAAI,YAAA,CAAa,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACpD,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,KAAA,MAAW,WAAW,YAAA,EAAc;AAClC,MAAA,IAAI;AACF,QAAA,OAAA,CAAQ,QAAQ,CAAA;AAAA,MAClB,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AAWA,EAAA,SAAS,iBAAA,GAA0B;AACjC,IAAA,IAAI,WAAA,CAAY,IAAA,KAAS,CAAA,IAAK,KAAA,KAAU,MAAA,EAAW;AACnD,IAAA,IAAI,CAAC,UAAA,CAAW,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,KAAA;AACjB,IAAA,MAAM,MAAA,GAAS,CAAC,GAAG,WAAW,CAAA;AAC9B,IAAA,WAAA,CAAY,KAAA,EAAM;AAClB,IAAA,KAAA,MAAW,OAAA,IAAW,MAAA,EAAQ,OAAA,CAAQ,QAAQ,CAAA;AAAA,EAChD;AAWA,EAAA,eAAe,aAAa,GAAA,EAAuB;AACjD,IAAA,IAAI,UAAU,MAAA,EAAW;AAEvB,MAAA,MAAM,IAAI,MAAM,iCAAiC,CAAA;AAAA,IACnD;AAKA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACF,MAAA,CAAC,IAAA,EAAM,IAAI,CAAA,GAAI,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IACvC,SAAS,WAAA,EAAa;AAEpB,MAAA,WAAA,CAAY,WAAA,EAAa,EAAE,KAAA,EAAO,QAAA,EAAU,CAAA;AAC5C,MAAA,QAAQ,YAAY,QAAA;AAAU,QAC5B,KAAK,SAAA,EAAW;AAQd,UAAA,KAAA,GAAQ,WAAA,CAAY,SAAA,CAAU,KAAA,EAAO,GAAA,EAAK,WAAW,CAAA;AACrD,UAAA,IAAI,KAAA,EAAO,MAAM,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AACjC,UAAA,aAAA,EAAc;AAEd,UAAA,aAAA,EAAc;AACd,UAAA,aAAA,CAAc,GAAG,CAAA;AACjB,UAAA,UAAA,CAAW,GAAG,CAAA;AACd,UAAA,iBAAA,EAAkB;AAClB,UAAA;AAAA,QACF;AAAA,QACA,KAAK,UAAA;AAIH,UAAA,MAAM,WAAA;AAAA,QACR;AAKE,UAAA,OAAA,GAAU,IAAA;AACV,UAAA,MAAM,WAAA;AAAA;AACV,IACF;AACA,IAAA,KAAA,GAAQ,IAAA;AACR,IAAA,IAAI,KAAA,EAAO,MAAM,KAAA,CAAM,IAAA,CAAK,KAAK,CAAA;AAIjC,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,IAAI,CAAA;AACvB,IAAA,aAAA,EAAc;AACd,IAAA,aAAA,CAAc,GAAG,CAAA;AACjB,IAAA,UAAA,CAAW,GAAG,CAAA;AACd,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAqCA,EAAA,IAAI,kBAAgC,EAAC;AACrC,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,MAAM,GAAG,CAAA;AACvD,IAAA,KAAA,GAAQ,YAAA;AACR,IAAA,eAAA,GAAkB,QAAA;AAAA,EACpB;AAEA,EAAA,eAAe,eAAA,GAAiC;AAC9C,IAAA,IAAI,KAAA,EAAO;AAQT,MAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,IAAA,EAAK;AAC7B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAChC,MAAA,MAAM,CAAC,YAAA,EAAc,QAAQ,IAAI,OAAA,CAAQ,IAAA,CAAK,QAAQ,GAAG,CAAA;AACzD,MAAA,KAAA,GAAQ,YAAA;AACR,MAAA,eAAA,GAAkB,QAAA;AAClB,MAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,aAAA,EAAc;AACd,IAAA,MAAM,aAAa,eAAe,CAAA;AAClC,IAAA,aAAA,EAAc;AAId,IAAA,QAAA,EAAS;AAGT,IAAA,iBAAA,EAAkB;AAAA,EACpB;AAYA,EAAA,SAAS,gBAAgB,GAAA,EAAuB;AAC9C,IAAA,IAAI,OAAA;AACF,MAAA,OAAO,OAAA,CAAQ,MAAA,CAAO,IAAI,KAAA,CAAM,8BAA8B,CAAC,CAAA;AACjE,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,CAAK,MAAM;AAC3B,MAAA,IAAI,SAAA,KAAc,MAAM,MAAM,SAAA;AAC9B,MAAA,OAAO,aAAa,GAAG,CAAA;AAAA,IACzB,CAAC,CAAA;AAID,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,MAAM;AAAA,IAAC,CAAC,CAAA;AAC1B,IAAA,OAAO,IAAA;AAAA,EACT;AAgBA,EAAA,eAAe,iBAAA,GAAmC;AAChD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,OAAA,EAAS,CAAA,EAAA,EAAK;AAChC,MAAA,MAAM,QAAA,GAAW,IAAA;AACjB,MAAA,MAAM,QAAA;AACN,MAAA,IAAI,SAAS,QAAA,EAAU;AAAA,IACzB;AACA,IAAA,MAAM,IAAI,uBAAuB,OAAO,CAAA;AAAA,EAC1C;AAYA,EAAA,eAAe,oBAAA,CACb,KACAC,KAAAA,EACe;AACf,IAAA,MAAM,gBAAgB,GAAG,CAAA;AACzB,IAAA,IAAIA,KAAAA,EAAM,WAAW,MAAA,EAAQ;AAC7B,IAAA,MAAM,iBAAA,EAAkB;AAAA,EAC1B;AAaA,EAAA,MAAM,cAAc,eAAA,EAAgB;AACpC,EAAA,IAAA,GAAO,WAAA,CAAY,KAAA,CAAM,CAAC,GAAA,KAAQ;AAChC,IAAA,SAAA,GAAY,GAAA;AAAA,EACd,CAAC,CAAA;AASD,EAAA,MAAM,eAA0C,WAAA,CAAY,IAAA;AAAA,IAC1D,MAAM;AAAA,GACR;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,QAAA,EAAU,oBAAA;AAAA,IACV,YAAA,EAAc,eAAA;AAAA,IACd,QAAA,GAAc;AAaZ,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IACA,UAAU,QAAA,EAAkC;AAC1C,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAQ,QAAA,EAAkD;AACxD,MAAA,SAAA,CAAU,IAAI,QAAQ,CAAA;AACtB,MAAA,OAAO,MAAM;AACX,QAAA,SAAA,CAAU,OAAO,QAAQ,CAAA;AAAA,MAC3B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,OAAO,OAAA,EAAyC;AAI9C,MAAA,IAAI,MAAA,IAAU,UAAU,MAAA,EAAW;AACjC,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,QACf,SAAS,GAAA,EAAK;AACZ,UAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,QACnB;AACA,QAAA,OAAO,MAAM;AAAA,QAAC,CAAA;AAAA,MAChB;AACA,MAAA,YAAA,CAAa,IAAI,OAAO,CAAA;AACxB,MAAA,OAAO,MAAM;AACX,QAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAAA,MAC7B,CAAA;AAAA,IACF,CAAA;AAAA,IACA,EAAA,CACE,MACA,OAAA,EACY;AAKZ,MAAA,IAAI,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AACnC,MAAA,IAAI,WAAW,MAAA,EAAW;AACxB,QAAA,MAAA,uBAAa,GAAA,EAAwB;AACrC,QAAA,aAAA,CAAc,GAAA,CAAI,MAAM,MAAM,CAAA;AAAA,MAChC;AACA,MAAA,MAAM,MAAA,GAAS,OAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,aAAA,CAAc,GAAA,CAAI,IAAI,CAAA;AAClC,QAAA,IAAI,QAAQ,MAAA,EAAW;AACvB,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,aAAA,CAAc,OAAO,IAAI,CAAA;AAAA,MAC/C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,aAAA,CAAiB,MAAe,QAAA,EAA0C;AACxE,MAAA,MAAM,GAAA,GAAM,IAAA;AACZ,MAAA,IAAI,MAAA,GAAS,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AACjC,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAA,uBAAa,GAAA,EAA8B;AAC3C,QAAA,YAAA,CAAa,GAAA,CAAI,KAAK,MAAM,CAAA;AAAA,MAC9B;AAIA,MAAA,MAAM,MAAA,GAAS,QAAA;AACf,MAAA,MAAA,CAAO,IAAI,MAAM,CAAA;AACjB,MAAA,OAAO,MAAM;AACX,QAAA,MAAM,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,GAAG,CAAA;AAChC,QAAA,IAAI,CAAC,GAAA,EAAK;AACV,QAAA,GAAA,CAAI,OAAO,MAAM,CAAA;AACjB,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,CAAA,EAAG,YAAA,CAAa,OAAO,GAAG,CAAA;AAAA,MAC7C,CAAA;AAAA,IACF,CAAA;AAAA,IACA,QAAA,CAAY,MAAe,KAAA,EAAgB;AAKzC,MAAA,QAAA,CAAS,MAAM,KAAK,CAAA;AAAA,IACtB,CAAA;AAAA;AAAA;AAAA;AAAA,IAIA,KAAA,EAAO,YAAA;AAAA,IACP,IAAA,GAAsB;AAOpB,MAAA,OAAO,iBAAA,EAAkB;AAAA,IAC3B,CAAA;AAAA,IACA,MAAA,GAAwB;AAKtB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,OAAO,UAAA,CAAW,OAAO,CAAA,GAAI,OAAA,GAAU,MAAA;AAAA,IACzC,CAAA;AAAA,IACA,IAAA,GAAmB;AAGjB,MAAA,MAAM,OAAA,GAAU,KAAA;AAChB,MAAA,IAAI,WAAW,OAAO,CAAA,EAAG,OAAO,OAAA,CAAQ,QAAQ,OAAO,CAAA;AAIvD,MAAA,OAAO,IAAI,OAAA,CAAW,CAAC,OAAA,KAAY;AACjC,QAAA,WAAA,CAAY,IAAI,OAAO,CAAA;AAAA,MACzB,CAAC,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,IAAA,GAAsB;AAC1B,MAAA,OAAA,GAAU,IAAA;AAIV,MAAA,MAAM,IAAA;AAGN,MAAA,KAAA,MAAW,CAAC,EAAA,EAAI,OAAO,CAAA,IAAK,WAAA,EAAa;AACvC,QAAA,IAAI;AACF,UAAA,OAAA,EAAQ;AAAA,QACV,SAAS,GAAA,EAAK;AACZ,UAAA,OAAA,CAAQ,MAAM,GAAG,CAAA;AAAA,QACnB;AACA,QAAA,WAAA,CAAY,OAAO,EAAE,CAAA;AAAA,MACvB;AAKA,MAAA,IAAI,KAAA,IAAS,KAAA,KAAU,MAAA,IAAa,SAAA,KAAc,IAAA,EAAM;AACtD,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,CAAM,KAAK,KAAK,CAAA;AAAA,QACxB,SAAS,KAAA,EAAO;AACd,UAAA,WAAA,CAAY,KAAA,EAAO,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAAA,QAC3C;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,OAAO,OAAA;AACT;AA6EO,SAAS,cAAA,CACd,SACA,IAAA,EACsB;AACtB,EAAA,MAAM,SAAwC,EAAC;AAC/C,EAAA,IAAI,OAAA,GAAU,KAAA;AAEd,EAAA,MAAM,IAAA,GAAO,CAAC,KAAA,KAA6C;AACzD,IAAA,MAAA,CAAO,KAAK,KAAK,CAAA;AACjB,IAAA,IAAI,MAAA,CAAO,MAAA,GAAS,IAAA,EAAM,MAAA,CAAO,KAAA,EAAM;AAAA,EACzC,CAAA;AAMA,EAAA,MAAM,SAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,OAAA,CAAQ,CAAC,KAAK,KAAA,KAAU;AAC9B,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAAA,EACrB,CAAC,CAAA;AACP,EAAA,MAAM,MAAA,GACJ,IAAA,IAAQ,CAAA,GACJ,MAAY;AAAA,EAAC,CAAA,GACb,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,KAAU;AACxB,IAAA,IAAA,CAAK,EAAE,GAAA,EAAK,IAAA,EAAM,KAAA,EAAO,CAAA;AAAA,EAC3B,CAAC,CAAA;AAEP,EAAA,OAAO;AAAA,IACL,QAAA,GAAW;AAGT,MAAA,OAAO,OAAO,KAAA,EAAM;AAAA,IACtB,CAAA;AAAA,IACA,IAAA,GAAO;AACL,MAAA,IAAI,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,SAAA,EAAU;AACV,MAAA,MAAA,EAAO;AAAA,IACT;AAAA,GACF;AACF;AAgBO,SAAS,MAAA,CAOd,SACA,IAAA,EACoC;AAGpC,EAAA,MAAM,MAAA,GAAS,KAAK,MAAA,IAAU,IAAA;AAC9B,EAAA,MAAM,CAAC,cAAc,QAAQ,CAAA,GAAI,QAAQ,IAAA,CAAK,MAAA,EAAQ,KAAK,GAAG,CAAA;AAE9D,EAAA,IAAI,MAAA,KAAW,IAAA,IAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAG;AAC1C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KASF;AAAA,EACF;AAOA,EAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,UAAA,EAAW,GAAI,WAAA;AAAA,IAClC,OAAA;AAAA,IACA,YAAA;AAAA,IACA,IAAA,CAAK;AAAA,GACP;AACA,EAAA,MAAM,IAAA,GAAY,CAAC,GAAG,QAAA,EAAU,GAAG,UAAU,CAAA;AAE7C,EAAA,MAAM,IAAA,GAAY,OAAA,CAAQ,aAAA,GACtB,CAAC,GAAG,QAAQ,aAAA,CAAc,KAAK,CAAC,CAAA,GAChC,EAAC;AAEL,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,IAAA,EAAK;AAC7B;AAiBO,SAAS,YAAA,CACd,IAAA,EACA,IAAA,EACA,KAAA,EACkC;AAClC,EAAA,OAAO,OAAO,KAAK,GAAA,KAAQ;AACzB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW;AAAA,MACrC,GAAA,EAAK,MAAM,IAAA,CAAK,GAAA,EAAK,GAAG,CAAA;AAAA,MACxB,KAAA,EAAO,CAAC,KAAA,KAA4B;AAAA,KACrC,CAAA;AACD,IAAA,OAAO,OAAO,KAAA,CAAM;AAAA,MAClB,EAAA,EAAI,CAAC,KAAA,KAAU,IAAA,CAAK,OAAO,GAAG,CAAA;AAAA,MAC9B,GAAA,EAAK,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,GAAG;AAAA,KACjC,CAAA;AAAA,EACH,CAAA;AACF","file":"chunk-2WZHS4P2.js","sourcesContent":["/**\n * @demlik/tea — TEA-faithful state machine substrate.\n *\n * This module exposes the full Locked API Surface from the PRD as types and\n * implements `defineMachine` (identity, task 1), `run` (task 2), and\n * `replay` + `tryInterpret` (task 3).\n *\n * `replay` is the pure unit-test tool: it composes `init` + `update` only,\n * never touches `Store`, never calls `interpret`, never starts subscriptions.\n *\n * `tryInterpret` is Railway sugar — wraps a fallible async function and routes\n * Ok/Err to two Msg constructors via better-result.\n */\n\nimport { Result } from \"better-result\";\nimport type {\n  Machine,\n  Port,\n  PortEmitter,\n  Reducer,\n  Sub,\n  Transitions,\n  UpdateForm,\n} from \"./pure/core\";\nimport {\n  __DEV__,\n  assertPureResult,\n  type Cmd,\n  deepFreeze,\n  detectUpdateForm,\n  foldUpdates,\n  formOf,\n} from \"./pure/core\";\n\nexport type {\n  ContextFree,\n  Interpret,\n  Machine,\n  NoCtx,\n  Port,\n  PortEmitter,\n  Reducer,\n  Sub,\n  SubId,\n  Subscribe,\n  SyncReturn,\n  Transitions,\n  UpdateForm,\n} from \"./pure/core\";\n// Re-export the pure-core surface so the root `@demlik/tea` entry is unchanged\n// (additive; the runtime-free guarantee lives on `@demlik/tea/pure`).\nexport { Cmd, detectUpdateForm, foldMsgs, formOf, subId } from \"./pure/core\";\n\n// The nominal brand minted ONLY through the validated construction path\n// (`asReducer` / `defineMachine`). Mirrors `retry-backoff`'s `RngBrand`: a raw\n// record of handlers is a structural `Reducer<S, M, C>`, but a `Reducer` that\n// also carries this phantom brand is one that has passed through the single\n// minting boundary. The brand is an *optional* phantom so the structural\n// `Reducer<S, M, C>` annotation form (`const update: Reducer<...> = { ... }`)\n// keeps accepting plain object literals — the guard that actually rejects an\n// async reducer is `SyncReturn`'s non-thenable return, enforced on every cell.\ndeclare const ReducerBrand: unique symbol;\n\n// A `Reducer` (or `Transitions`) that has been minted through `asReducer` /\n// `defineMachine`. Carries the phantom brand; otherwise identical to its\n// structural counterpart.\nexport type Branded<T> = T & { readonly [ReducerBrand]: true };\n\n// === absurd: compile-time exhaustiveness assertion ===\n//\n// Use in default branches of switches over discriminated unions where every\n// case should be handled explicitly. TS narrows the operand to `never` only\n// if every variant has been covered upstream; adding a new variant produces\n// a compile error at the `absurd(x)` site.\n//\n// The substrate's `Reducer<S, M, C>` and `Transitions<S, M, C>` forms cover\n// the reducer-side exhaustiveness with mapped types — no `absurd` needed\n// there. This helper exists for the OTHER boundaries where a discriminated\n// union is narrowed by hand: Sub handlers mapping a wire-protocol\n// discriminant to flat Msg variants, message-bridge dispatchers, port\n// fanouts, etc. Without it, consumers redeclare the same 3-line helper\n// across files; with it, the substrate owns the one canonical version.\n//\n// Strengthens invariant 7 (identity is explicit).\n/**\n * Compile-time exhaustiveness assertion. Use in default branches of\n * switches over discriminated unions where every case should be handled\n * explicitly — TS narrows the type to `never` only if every variant has\n * been covered. Strengthens invariant 7 (identity is explicit).\n *\n * @example\n *   switch (msg.type) {\n *     case \"a\": return ...;\n *     case \"b\": return ...;\n *     default: return absurd(msg);  // compile error if a \"c\" is added\n *   }\n */\nexport function absurd(x: never): never {\n  throw new Error(`unreachable: ${JSON.stringify(x)}`);\n}\n\n// === noop: the explicit \"this cell ignores this msg\" helper ===\n//\n// Elm's fallback for unhandled (state × msg) pairs is implicit:\n// `_ -> (model, Cmd.none)` in a case expression. We make it explicit because\n// implicit no-ops are silent regressions waiting to happen — a future Msg\n// variant that *should* be handled gets swallowed by the wildcard.\n//\n// Naming the no-op forces the author to *decide*: \"this cell does nothing\"\n// is a real decision, distinct from \"I forgot to write this cell.\" The\n// mapped type rejects the second case; `noop` names the first.\n//\n// Assignable to any Transitions cell regardless of S/M/C concrete types\n// (the type parameters are free) — drop it into any cell without per-type\n// casts.\nexport const noop = <S, M, C extends Cmd>(\n  state: S,\n  _msg: M,\n): readonly [S, readonly C[]] => [state, []];\n\n// Module-level registry — process-scope, identity-by-name. The set is the\n// runtime witness that every port name in this process is unique. Cleared\n// only by the test-only `__resetPortRegistry()` helper.\nconst definedPortNames = new Set<string>();\n\n/**\n * Thrown by `definePort` when a name has already been registered in the\n * current process. Symmetric with the `Sub.id` collision assert in\n * `reconcileSubs` — both mechanize invariant 7 (identity is explicit) at the\n * runtime layer the type system cannot reach (string names compared at\n * runtime, not at compile time).\n */\nexport class PortNameCollisionError extends Error {\n  override readonly name = \"PortNameCollisionError\";\n  constructor(portName: string) {\n    super(\n      `definePort: a port named \"${portName}\" was already defined. ` +\n        `Each definePort call must use a unique name. ` +\n        `If two modules need the same port, export it from one module and import it.`,\n    );\n  }\n}\n\n/**\n * Test-only escape hatch — clears the module-level port-name registry so the\n * collision assert in `definePort` doesn't false-positive across vitest's\n * non-isolated runs. Production code MUST NOT call this; the registry is the\n * invariant-7 witness for the process lifetime.\n *\n * @internal test-only\n */\nexport function __resetPortRegistry(): void {\n  definedPortNames.clear();\n}\n\n// === Runtime error sink (invariant 6 — no silent failures) ===\n//\n// The runtime has points where a failure has no natural caller to reject at:\n// a follow-up Msg an interpret handler enqueued (the original dispatcher\n// already resolved), and the final `store.save` during `stop()` (whose\n// contract is a resolved Promise). Historically both were swallowed —\n// `.catch(() => {})` and a bare `console.error` — which violates invariant 6:\n// the runtime must be inspectable; no silent failures.\n//\n// `RuntimeErrorContext` tags WHICH swallowed path produced the error so a sink\n// can route by phase. `OnError` is the sink itself, configured at `run(...)`.\n// When no sink is provided the runtime uses `defaultOnError`, which RE-THROWS\n// on a fresh macrotask — surfacing to the host's unhandled-rejection / global\n// error handler rather than vanishing. The default surfaces; it never swallows.\n\n/**\n * Which otherwise-unattributable runtime path produced an error.\n *\n * - `\"follow-up\"` — a follow-up Msg an interpret handler returned rejected\n *   when re-dispatched. The original dispatcher already resolved, so this\n *   rejection has no caller; without the sink it was swallowed.\n * - `\"stop-save\"` — the final `store.save(state)` inside `stop()` threw.\n *   `stop()` resolves regardless (its contract), so without the sink this was\n *   silent loss of the last write.\n * - `\"reduce\"` — the pure `update` (reducer) threw synchronously while folding\n *   a Msg. #71's reentrancy brand makes a reducer provably synchronous, so this\n *   throw is catchable in the dispatch loop; the configured `Supervision`\n *   strategy decides what the runtime does next (`stop` / `escalate` /\n *   `restart`), but the failure is ALWAYS surfaced here as data first.\n */\nexport type RuntimeErrorPhase = \"follow-up\" | \"stop-save\" | \"reduce\";\n\n/** Context handed to an `OnError` sink alongside the error itself. */\nexport interface RuntimeErrorContext {\n  readonly phase: RuntimeErrorPhase;\n}\n\n/**\n * Sink for runtime failures that have no caller to reject at. Configured via\n * `run(machine, { onError })`. Should be total — a throw inside the sink is\n * itself surfaced via `defaultOnError`, so the sink can never re-introduce a\n * silent failure.\n */\nexport type OnError = (error: unknown, context: RuntimeErrorContext) => void;\n\n/**\n * Default `onError` sink: re-throw on a fresh macrotask so the failure reaches\n * the host's global error / unhandledRejection handler instead of vanishing.\n * Used whenever `run(...)` is called without an explicit `onError`. The least\n * surprising default — it surfaces rather than swallows (invariant 6) without\n * forcing every caller to wire a sink.\n */\nfunction defaultOnError(error: unknown, _context: RuntimeErrorContext): void {\n  setTimeout(() => {\n    throw error;\n  }, 0);\n}\n\n// === Supervision: declared policy for a reducer throw (ADR 0003 #4) ===\n//\n// The resilience kit (retry, circuit-breaker, …) covers *effect* failures —\n// throws inside `interpret`. A throw inside the pure `update` (the reducer) had\n// no declared policy: it simply rejected the dispatch promise and left the\n// runtime in an ambiguous \"did we halt or not?\" state. #71's reentrancy brand\n// makes a reducer provably synchronous, so a reducer throw is now a synchronous\n// throw catchable in the dispatch loop. This is the seam Akka supervisor\n// strategies / Erlang-OTP supervision trees occupy: \"let it crash\" becomes\n// CONFIG, not hope.\n//\n// Every strategy routes the failure to the `onError` sink with `phase:\n// \"reduce\"` FIRST (invariant 6 — errors are data, never silently swallowed),\n// then differs in what the runtime does next:\n//\n//   - `stop`    — halt the runtime. State is NOT advanced; the dispatch promise\n//                 rejects with the reducer error; every subsequent dispatch\n//                 rejects (\"runtime stopped\"). The SAFE DEFAULT: a reducer that\n//                 violated its own invariants does not get to keep folding.\n//                 Never a silent resume.\n//   - `escalate`— surface via `onError` AND propagate: the dispatch promise\n//                 rejects with the reducer error so the failure bubbles to the\n//                 caller/parent supervisor. The runtime is NOT halted (a parent\n//                 may choose to keep dispatching) — escalation is \"tell someone\n//                 above me\", not \"die\".\n//   - `restart` — re-initialize from a host-provided last-known-good state and\n//                 keep folding. The core does NOT own snapshot logic; the host\n//                 supplies `rehydrate()`, the core invokes it, installs its\n//                 result as the new state, and continues the transition\n//                 (save → reconcile → interpret → fire) from there. The\n//                 original failure is still surfaced as data via `onError`.\n//\n// The restart rehydrate is a host callback by design: the core has no opinion\n// on where last-known-good state lives (a snapshot Store, an in-memory cache, a\n// recomputed default). Mirrors how `Store` keeps persistence out of core.\n\n/** The three declared reducer-throw supervision strategies. */\nexport type SupervisionStrategy = \"stop\" | \"escalate\" | \"restart\";\n\n/**\n * Declared supervision policy for a reducer (`update`) throw, configured at\n * `run(machine, { supervision })`.\n *\n * - `{ strategy: \"stop\" }` — halt + surface (the safe default; also the bare\n *   shorthand `\"stop\"`).\n * - `{ strategy: \"escalate\" }` — surface + propagate, runtime stays live (also\n *   the bare shorthand `\"escalate\"`).\n * - `{ strategy: \"restart\", rehydrate }` — surface, then re-init from the\n *   host-supplied last-known-good `S` and keep folding. `rehydrate` receives\n *   the failing `(state, msg, error)` so the host can log / pick a snapshot;\n *   it MUST return a valid `S` synchronously (the reducer is synchronous, so\n *   recovery is too — no suspension across the single-writer slot).\n *\n * The bare-string shorthands (`\"stop\"` / `\"escalate\"`) are accepted for the two\n * strategies that need no host data; `restart` MUST be the object form because\n * it carries the `rehydrate` callback.\n */\nexport type Supervision<S, M extends { type: string }> =\n  | \"stop\"\n  | \"escalate\"\n  | { readonly strategy: \"stop\" }\n  | { readonly strategy: \"escalate\" }\n  | {\n      readonly strategy: \"restart\";\n      /**\n       * Host-provided rehydration to last-known-good state. Invoked by the core\n       * when the reducer throws; its return value becomes the new state and the\n       * transition continues from there. Receives the pre-throw `state`, the\n       * `msg` that triggered the throw, and the thrown `error` so the host can\n       * route by cause.\n       */\n      readonly rehydrate: (state: S, msg: M, error: unknown) => S;\n    };\n\n/**\n * Normalize the `Supervision` config (bare string or object) into a single\n * object shape so the dispatch loop branches on `.strategy` once. The default\n * — applied when `run(...)` is called without `supervision` — is `stop`: the\n * explicit, safe choice. It surfaces via `onError` and halts; it never silently\n * resumes a machine whose reducer just violated an invariant (invariant 6).\n */\ntype NormalizedSupervision<S, M extends { type: string }> =\n  | { readonly strategy: \"stop\" }\n  | { readonly strategy: \"escalate\" }\n  | {\n      readonly strategy: \"restart\";\n      readonly rehydrate: (state: S, msg: M, error: unknown) => S;\n    };\n\nfunction normalizeSupervision<S, M extends { type: string }>(\n  supervision: Supervision<S, M> | undefined,\n): NormalizedSupervision<S, M> {\n  if (supervision === undefined) return { strategy: \"stop\" };\n  if (typeof supervision === \"string\") return { strategy: supervision };\n  return supervision;\n}\n\n/**\n * Raised by `idle()` when the quiescence wait hits its iteration cap without\n * the dispatch tail stabilizing. Replaces the old silent fall-through-resolve\n * (which made \"the loop quiesced\" indistinguishable from \"we gave up\"):\n * `idle()` now REJECTS with this so a livelocking machine surfaces instead of\n * masquerading as quiescent.\n *\n * Mechanizes invariant 6 (no silent failures) at the runtime layer — the same\n * role `PortNameCollisionError` plays for invariant 7.\n */\nexport class QuiescenceTimeoutError extends Error {\n  override readonly name = \"QuiescenceTimeoutError\";\n  constructor(public readonly iterations: number) {\n    super(\n      `@demlik/tea: idle() did not reach quiescence after ${iterations} ` +\n        `iterations — the dispatch tail kept advancing. The machine is ` +\n        `likely livelocking (an interpret handler enqueues a follow-up Msg ` +\n        `that enqueues another, without end). Bound the follow-up chain in ` +\n        `the reducer, or stop the runtime.`,\n    );\n  }\n}\n\n/**\n * Define a typed port. `name` is metadata (shown in devtools / debug logs);\n * port identity is by reference. Each definePort call must use a unique\n * `name` — a second call with the same name throws\n * `PortNameCollisionError`. If two modules need the same port, export it\n * from one module and import it from the other.\n *\n * Use ports for \"data leaving the runtime selectively\" — e.g. cursor\n * announcements, DOM-mutation broadcasts, telemetry events that should NOT be\n * folded into State and should NOT be observed by every transition listener.\n *\n * Strengthens invariant 7 (identity is explicit) — the runtime assert is the\n * Port-side counterpart of `SubId`'s id collision check in `reconcileSubs`.\n */\nexport function definePort<T>(name: string): Port<T> {\n  // HMR skip — Vite / dev servers re-import the module on hot reload, which\n  // would otherwise false-positive on every definePort across reloads. The\n  // try/catch is load-bearing for service-worker bundles: Vite polyfills\n  // `import.meta.url` via `document.baseURI`, which throws ReferenceError in\n  // an MV3 service worker. A throw here would abort SW install (Chrome\n  // surfaces it as \"registration failed status 15\"). Catching it = \"no HMR\n  // detected\" = the collision check applies, which is the correct SW\n  // behavior (SWs reload via chrome.runtime.reload, not module HMR).\n  let isHmr = false;\n  try {\n    const meta = import.meta as { hot?: unknown };\n    isHmr = meta?.hot !== undefined && meta?.hot !== null;\n  } catch {\n    isHmr = false;\n  }\n  if (!isHmr && definedPortNames.has(name)) {\n    throw new PortNameCollisionError(name);\n  }\n  definedPortNames.add(name);\n  return { __brand: \"port\", name } as Port<T>;\n}\n\n// === Store: pluggable persistence adapter ===\n//\n// `load()` returns `unknown` because storage genuinely doesn't know `S` —\n// chrome.storage returns whatever JSON lives at the key, DurableObjectStorage\n// returns whatever bytes were serialized. Casting raw storage to `S` at the\n// adapter boundary is the exact `as S` move forbidden by invariant 8\n// everywhere else in the substrate. `load()` returning `unknown` makes the\n// substrate stop pretending.\n//\n// `migrate(raw)` is the boundary parse. Returns `S` on a recognized shape —\n// the substrate passes it to `init` as `loaded`. Returns `null` on any\n// unrecognized shape — the substrate passes `null` to `init`, fresh-boot\n// path. Must NOT throw: if a future shape is unrecognizable, returning\n// `null` boots clean from a known-good path. Throwing here would\n// indistinguishably collapse \"storage corruption\" and \"schema migration not\n// yet written\" — both are runtime decisions, not panics.\n//\n// Strengthens invariant 8 (the boundary parses; the core trusts) — the\n// substrate now enforces the parse instead of relying on every adapter\n// remembering to.\nexport interface Store<S> {\n  load(): Promise<unknown>;\n  save(state: S): Promise<void>;\n  migrate(raw: unknown): S | null;\n}\n\n// === DispatchSettle: how far a dispatch awaits ===\n//\n// `dispatch(msg)` settles ONE transition by default would be the dangerous\n// choice (issue #50): an `interpret` handler that returns a follow-up Msg\n// enqueues a FRESH transition on the tail, and that follow-up is fire-and-\n// forget relative to the original `dispatch`. Callers that forgot to also\n// `await idle()` saw their dispatch resolve \"early\", before the consequences\n// of the Msg had run — which is why the codebase grew `dispatchToIdle` and\n// tests fell back to `for (i<200) sleep(5)` polls.\n//\n// So the default is the SAFE one: `\"quiescent\"` — `dispatch` resolves only\n// once the entire transitive follow-up chain has drained (the same drain\n// `idle()` performs). The rare single-step case (a caller that genuinely wants\n// one transition and will await the tail itself) opts in with `\"once\"`, or\n// uses the `dispatchOnce` convenience.\nexport type DispatchSettle = \"quiescent\" | \"once\";\n\n// === RuntimeRef<M>: typed sibling-runtime handle ===\n//\n// A `RuntimeRef<M>` exposes only the inbox of a Runtime — `dispatch(msg)` (and\n// its single-step sibling `dispatchOnce(msg)`).\n// Use it as the field type when one runtime holds a reference to a *sibling*\n// runtime (composition by reduction across orthogonal lifecycles — invariant\n// 5). The holder learns the Msg shape it can send, nothing about the\n// referenced runtime's State, Cmd, Sub, Ctx, observers, listeners, or Port\n// fanout. That asymmetry is the point: cross-runtime coupling collapses to\n// \"I can put a Msg in your inbox\", which is the smallest coordination\n// surface that preserves typed cross-runtime calls.\n//\n// `Runtime<S, M>` extends `RuntimeRef<M>` structurally — every Runtime is\n// trivially a RuntimeRef. The narrowing happens at the *consumer's* Ctx\n// type, not via a runtime cast.\n//\n// Strengthens invariant 5 (composition by reduction — sibling runtimes\n// coordinate through the narrowest typed surface) and invariant 6 (runtime\n// is small and inspectable — what a holder *can* do to a sibling runtime is\n// exactly one method, not the full surface).\nexport interface RuntimeRef<M extends { type: string }> {\n  /**\n   * Put a Msg in the runtime's inbox and resolve once it has been processed.\n   *\n   * Runs to QUIESCENCE by default (issue #50): the returned promise settles\n   * only after the dispatched Msg AND every follow-up Msg its `interpret`\n   * handlers (transitively) returned have drained off the serial tail. This is\n   * the safe default — `await dispatch(msg)` means \"the consequences have run\",\n   * not \"one transition fired and the rest are racing\". Pass\n   * `{ settle: \"once\" }` (or call `dispatchOnce`) for the rare single-step\n   * case where the caller will await the tail itself.\n   *\n   * Rejection ordering: the ONE dispatched transition's own failure (a reducer\n   * / save / sub-start / interpret throw) surfaces first, on this promise. If\n   * that transition succeeds but the follow-up chain never stabilizes, the\n   * quiescent drain rejects with `QuiescenceTimeoutError` (same cap and same\n   * no-silent-give-up contract as `idle()` — issue #51). Follow-up Msg\n   * rejections themselves route to the `onError` sink, never here.\n   */\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  /**\n   * Dispatch `msg` and resolve after exactly ONE transition's effects settle,\n   * WITHOUT draining the follow-up chain. Equivalent to\n   * `dispatch(msg, { settle: \"once\" })`.\n   *\n   * This is the old (pre-#50) `dispatch` behavior, kept as an explicit escape\n   * hatch: a caller that wants to interleave its own work between the first\n   * transition and its follow-ups, then `await runtime.idle()` itself. Prefer\n   * plain `dispatch` (run-to-quiescence) unless you specifically need the\n   * single step — the un-awaited follow-up chain is exactly the footgun #50\n   * removed from the default.\n   */\n  dispatchOnce(msg: M): Promise<void>;\n}\n\n// === BootingRuntime: handle returned SYNCHRONOUSLY from run() ===\n//\n// `run()` returns a `BootingRuntime<S, M>` the instant it is called — boot\n// (store.load → init → save → reconcile → interpret-of-init-cmds → first\n// fanout) is still in flight. A BootingRuntime exposes exactly the surface\n// that is TOTAL before boot completes: you may queue a dispatch, subscribe a\n// listener, attach an observer, wire a Port, or stop the runtime — none of\n// those need the initial State to exist yet. What you may NOT do is read the\n// State (`getState`) or wait for quiescence (`idle`): there is no State to\n// read until boot has run `init`, and a half-booted runtime has no meaningful\n// \"quiescence\" to await. Those two are the difference between a BootingRuntime\n// and a `Runtime` — and that difference is enforced at the type level.\n//\n// `ready` resolves to the FULL `Runtime<S, M>` once boot completes (or rejects\n// with the boot error). It is the ONLY way to obtain a `Runtime`:\n//\n//   const runtime = await run(machine, opts).ready;\n//   runtime.getState(); // total — boot has run, State exists\n//\n// This closes issue #45: `getState(): S` used to be declared on the handle\n// `run()` returned synchronously, yet it THREW before boot under a store. The\n// type claimed total; the value was partial, and only JSDoc told you to await.\n// Splitting the booting handle from the ready runtime makes \"read State before\n// boot\" a COMPILE error rather than a runtime throw — the type no longer lies.\n//\n// `subscribe(listener)` is the React-shaped change notifier (zero-arg, paired\n// with `getState()` via `useSyncExternalStore` on the ready Runtime).\n// `observe(observer)` is the devtools-shaped trace hook: it receives `(msg,\n// state)` for every COMPLETED, APPLIED transition. The boot transition is NOT\n// an applied Msg — there is no event there, only the initial State — so it does\n// NOT flow through `observe`. It is delivered once via `onBoot(handler)`\n// instead, so `observe`'s `msg` is total (`M`, never `null`): a consumer no\n// longer carries a `| null` boot arm it then ignores (#47). Both `observe` and\n// `onBoot` fire from the same point in the dispatch loop (after save →\n// reconcile → interpret), so what they see is consistent with what a subscriber\n// sees via the ready Runtime's `getState()`.\n//\n// Observe is separate from subscribe because the contracts differ: React\n// consumers want \"something changed, re-read state\"; devtools consumers want\n// \"here is the exact (msg, state) pair, append it to a log\". Folding them\n// would force every React subscriber to type-check a `msg` arg they will never\n// use, and would couple `useSyncExternalStore` to a particular Msg type at the\n// substrate.\n//\n// `on(type, handler)` is the SEMANTIC event channel (#47): a typed subscription\n// to the machine-level `AgentEvent`-style union `E` a machine projects off its\n// transitions (via `run`'s `events` projector). Where `observe` hands every\n// consumer the raw `(M, S)` firehose to hand-filter — coupling a UI to the\n// machine's PRIVATE Msg vocabulary (e.g. a retry plumbing's `resilient_ok`) —\n// `on` delivers only the public, named events, narrowed to the requested\n// `type`. `E` defaults to `never`: a machine that wires no `events` projector\n// has an empty event surface and `on` is uncallable (no `E[\"type\"]` to pass).\nexport interface BootingRuntime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends RuntimeRef<M> {\n  dispatch(msg: M, opts?: { readonly settle?: DispatchSettle }): Promise<void>;\n  dispatchOnce(msg: M): Promise<void>;\n  subscribe(listener: () => void): () => void;\n  observe(observer: (msg: M, state: S) => void): () => void;\n  /**\n   * Subscribe to the INITIAL State — the boot transition the old `observe`\n   * `msg === null` arm carried (#47). Fires exactly once: immediately if boot\n   * has already completed when `onBoot` is called (so a late subscriber never\n   * misses it), otherwise on the boot fanout. Returns a cleanup that detaches\n   * the handler (a no-op once it has fired).\n   *\n   * This is where the boot case the `observe` firehose used to fold in went\n   * once `observe`'s `msg` became total: a consumer that needs to seed a view\n   * from the initial State wires `onBoot`; a consumer that only folds events\n   * (the common case) wires `observe` (or `on`) and is no longer handed a boot\n   * arm to skip.\n   */\n  onBoot(handler: (state: S) => void): () => void;\n  /**\n   * Subscribe to a SEMANTIC event of `type` (#47). Typed narrowing: the handler\n   * receives exactly the `E` member whose `type` matches `K`, so a consumer\n   * built on `on(\"TurnSettled\", …)` never touches another event's shape and —\n   * critically — never references the machine's PRIVATE Msg names. Returns a\n   * cleanup that detaches the handler. Multiple handlers per type are\n   * supported; fanout is synchronous and throw-isolated (same discipline as\n   * `observe`). Fires only when the machine's `events` projector (wired on\n   * `run`) emits an event of that type for a transition.\n   */\n  on<K extends E[\"type\"]>(\n    type: K,\n    handler: (event: Extract<E, { type: K }>) => void,\n  ): () => void;\n  /**\n   * Subscribe to a typed Port. Returns a cleanup function that removes the\n   * listener. Multiple listeners per port are supported; fanout is synchronous\n   * (same shape as `observe`) and isolated — one listener throw does not strand\n   * the others.\n   *\n   * Ports are for \"data leaving the runtime selectively\" — see `definePort`.\n   * Distinct from `observe` (every transition) and from State (the world).\n   */\n  subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void;\n  /**\n   * Emit a value on a Port from OUTSIDE an interpret handler. Same synchronous\n   * fanout discipline as `ctx.emit` inside interpret — every subscriber\n   * receives the value immediately; emitting to a port with no subscribers is\n   * a no-op; listener throws are isolated.\n   *\n   * Use this for `observe`-driven Port emission: the canonical case is one\n   * runtime publishing a state-derived signal (e.g. \"am I idle?\") that\n   * another runtime subscribes to via `subscribePort`. Without\n   * `runtime.emitPort`, the only way to emit a Port is from inside an\n   * `interpret` handler — which forces the reducer to spawn a \"tell the\n   * outside world\" Cmd on every transition that should signal. With it,\n   * `runtime.observe((msg, state) => runtime.emitPort(port, derive(state)))`\n   * keeps the reducer free of Port-plumbing Cmds and matches the \"every\n   * transition is observable\" contract this invariant set already commits to.\n   *\n   * Strengthens invariant 6 (runtime is small and inspectable — Port emission\n   * is no longer privileged to interpret handlers; `observe`-driven emission\n   * is structurally supported).\n   */\n  emitPort<T>(port: Port<T>, value: T): void;\n  /**\n   * Resolves to the booted `Runtime<S, M>` after boot completes — i.e. after\n   * `store.load()` (if any), `init`, `store.save()` of the initial state,\n   * `reconcileSubs`, `interpret` of any init-emitted cmds, and the initial\n   * listener / observer fanout. Rejects with the boot error if boot fails (the\n   * same error every subsequent `dispatch` call rejects with).\n   *\n   * This is the ONLY way to obtain a `Runtime<S, M>` — and a `Runtime` is the\n   * only handle whose `getState()` is total. Awaiting `ready` is therefore the\n   * single gate between \"boot in flight\" and \"State exists\":\n   *\n   * ```ts\n   * const runtime = await run(machine, opts).ready;\n   * runtime.getState(); // total — never throws-before-boot\n   * ```\n   *\n   * Idempotent — subsequent reads return the same settled promise. The runtime\n   * holds exactly one `ready` promise per `run()` call; it resolves to the same\n   * `Runtime` object every time.\n   *\n   * Closes issue #45 (the `getState()` lie) and the v1 boot-await gap once\n   * documented in `stepBootEffects`: components that need synchronous initial\n   * state under a store (e.g. `useSyncExternalStore` consumers) await `ready`\n   * for the booted runtime instead of dispatching a no-op Msg.\n   *\n   * Expresses canon §2.3 (the `init` contract — boot is a named, awaitable\n   * moment). Strengthens invariant 6 (runtime is small and inspectable).\n   */\n  ready: Promise<Runtime<S, M, E>>;\n  stop(): Promise<void>;\n}\n\n// === Runtime: the BOOTED handle `ready` resolves to ===\n//\n// A `Runtime<S, M>` is a `BootingRuntime<S, M>` whose boot has completed. It\n// adds the two members that are only meaningful once the initial State exists:\n// `getState()` (total — boot ran `init`, so State is always present) and\n// `idle()` (quiescence is only definable on a runtime that has booted). It\n// also narrows `ready` to `Promise<Runtime<S, M>>` resolving to itself — a\n// booted runtime awaited again hands back the same booted runtime, so consumer\n// code that re-awaits (e.g. a cached `getRuntime()` accessor) keeps a total\n// `getState`.\n//\n// You never construct a `Runtime` directly from `run()`; you obtain it via\n// `await bootingRuntime.ready`. That asymmetry is the whole fix for #45 —\n// \"read State before boot\" is now unrepresentable, not merely discouraged.\nexport interface Runtime<\n  S,\n  M extends { type: string },\n  E extends { type: string } = never,\n> extends BootingRuntime<S, M, E> {\n  /**\n   * The current State. TOTAL — never throws. Obtaining a `Runtime` requires\n   * awaiting `ready`, which only resolves AFTER boot has run `init` and set the\n   * initial State; a `Runtime` therefore always has a State to return. (Before\n   * #45 this was declared on the synchronously-returned handle and threw under\n   * a store until boot finished — the type lied. It no longer does.)\n   */\n  getState(): S;\n  /**\n   * Resolves to this same `Runtime` once boot completes. Idempotent.\n   */\n  ready: Promise<Runtime<S, M, E>>;\n  /**\n   * Resolves once the runtime has reached QUIESCENCE — every dispatched Msg AND\n   * every follow-up Msg an interpret handler returned has been processed, with\n   * no further step pending on the serial tail.\n   *\n   * Since #50, plain `dispatch(msg)` already runs to quiescence (it awaits this\n   * same drain after its own transition), so a caller rarely needs `idle()`\n   * directly. `idle()` is still the right tool to (a) settle follow-ups left in\n   * flight by a `dispatchOnce` / `dispatch(msg, { settle: \"once\" })` single\n   * step, or (b) wait out a follow-up chain kicked off by a Sub or by boot\n   * `init` cmds where there was no `dispatch` call to await. It chains onto the\n   * current tail and re-checks until the tail stops advancing, draining the\n   * entire transitive follow-up chain.\n   *\n   * Idempotent and re-entrant-safe: each call reads the live tail; a tail that\n   * advanced during the await (a follow-up landed) is awaited again until\n   * stable. Tail rejections are NOT surfaced here — a failing dispatch\n   * surfaces on its OWN returned promise (and follow-up rejections route to\n   * the `onError` sink). The ONE rejection `idle()` itself produces is a\n   * `QuiescenceTimeoutError` when the wait hits its iteration cap without the\n   * tail stabilizing: that replaces the old silent fall-through-resolve so a\n   * livelocking machine is distinguishable from a genuinely quiesced one\n   * (invariant 6 — no silent failures).\n   *\n   * Use `idle()` for runtime-internal follow-ups; a poll is still correct when\n   * waiting on an EXTERNAL event (a WS reply) the runtime cannot enqueue itself.\n   *\n   * Strengthens invariant 6 (runtime is small and inspectable — quiescence is a\n   * first-class awaitable moment, not a poll the consumer re-derives).\n   */\n  idle(): Promise<void>;\n  /**\n   * The terminal State of the run, or `undefined` while it is still in flight.\n   * A run is \"terminal\" exactly when the `terminal` predicate passed to `run()`\n   * returns `true` for the current State; with no predicate supplied a run is\n   * never terminal and this always returns `undefined`.\n   *\n   * This is the FIRST-CLASS result read (issue #46): the outcome of running the\n   * thing, off the State the machine already owns — NOT scraped off the\n   * `observe` firehose by matching an internal Msg name (`resilient_ok`) and\n   * racing a state-clear. The consumer reads the run's product (e.g. an agent's\n   * `state.output`) off the returned `S`, with no coupling to the machine's\n   * private retry / loop vocabulary.\n   *\n   * Total — never throws (a `Runtime` always has a State; see `getState`).\n   */\n  result(): S | undefined;\n  /**\n   * Resolves with the terminal State the first time the run reaches a terminal\n   * State (per the `terminal` predicate passed to `run()`). If the run is\n   * ALREADY terminal when `done()` is called, resolves immediately with the\n   * current State; otherwise resolves on the transition that first makes\n   * `terminal` hold.\n   *\n   * The awaitable companion to `result()` — \"wait for the run to finish, then\n   * hand me what it produced\" in one call, instead of polling `result()` or\n   * hand-rolling an `observe` loop that watches for a private terminal Msg.\n   * With no `terminal` predicate supplied the run is never terminal, so this\n   * promise never resolves (a non-terminating machine has no result to await).\n   *\n   * Idempotent and multi-caller safe: every call observes the live State, so a\n   * call made after the run already terminated resolves at once, and concurrent\n   * callers all settle on the same terminal transition.\n   */\n  done(): Promise<S>;\n}\n\n// === defineMachine: identity-typed pass-through ===\n//\n// Overloads enforce exactly one `update` shape per call so consumers see a\n// concrete type for `update`, not the substrate-internal union. Implementation\n// is identity at runtime — the runtime (`run`) branches on the structural\n// shape of `update` (Reducer vs Transitions) when dispatching.\n//\n// - Reducer-form overload: `update: Reducer<S, M, C>` — flat record keyed by\n//   Msg.type. Exhaustiveness is enforced by the mapped type; adding a Msg\n//   variant without a matching key is a compile error.\n// - Transitions-form overload: `update: Transitions<S, M, C>` — 2D table\n//   keyed by State.type then Msg.type. Only available when `S extends {\n//   type: string }`.\n//\n// Distinguishing the two: TS overload resolution checks the literal shape of\n// the argument. Reducer values are functions; Transitions values are records\n// (of functions). Structurally distinct, so overload resolution picks the\n// right branch.\n//\n// Strengthens invariant 2 (record forms have no fall-through default) and\n// invariant 7 (the Msg variant set — and, for Transitions, the State variant\n// set — is load-bearing at the type level).\n\n// Transitions-form overload — `update` is a 2D table keyed by State.type\n// then Msg.type. Declared FIRST (most specific): the value shape (record of\n// records of functions) is structurally distinct from Reducer (record of\n// functions), so TS overload resolution picks this branch only when the\n// literal matches the table shape.\n//\n// The S constraint is expressed via a conditional `S extends { type: string\n// } ? Transitions<S, M, C> : never` instead of a generic-parameter\n// constraint. The conditional approach keeps `S` unconstrained at the\n// overload signature, so `Parameters<typeof defineMachine<NonDiscriminatedS,\n// ...>>` (the public `satisfies` pattern) doesn't fail at the first\n// overload — it just skips to the next one because `update` becomes\n// `never`.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    // `[S]` tuple-wrap disables distributive conditional behavior — see\n    // the comment on `Machine.update` for why distribution is wrong here.\n    update: [S] extends [{ type: string }] ? Transitions<S, M, C> : never;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Reducer-form overload — `update` is a flat record keyed by Msg.type.\n// Object literals where every property is a function match this shape.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  m: Omit<Machine<S, M, C, U, Ctx>, \"update\"> & {\n    update: Reducer<S, M, C>;\n  },\n): Machine<S, M, C, U, Ctx>;\n// Implementation signature — accepts both via the union on `Machine.update`.\nexport function defineMachine<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(m: Machine<S, M, C, U, Ctx>): Machine<S, M, C, U, Ctx> {\n  // Tag the update form ONCE, here at the typed construction boundary, so no\n  // downstream reader (`run`, `replay`, the `withX` wrappers) re-derives it\n  // structurally. Non-enumerable: it must not serialize, must not show up in\n  // `Object.keys(machine)`, and must not collide with any Msg.type key on a\n  // flattened surface. Idempotent under re-wrap (`defineMachine(defineMachine(m))`).\n  if (m.__form === undefined) {\n    Object.defineProperty(m, \"__form\", {\n      value: detectUpdateForm(m.update as object),\n      enumerable: false,\n      writable: false,\n      configurable: true,\n    });\n  }\n  return m;\n}\n\n// === asReducer: the validated minting path for a reducer (ADR 0003 #5) ===\n//\n// The single entry point that turns a raw record of handlers into a branded\n// `Reducer<S, M, C>` — the exact role `asRng` plays for `Rng` in\n// `retry-backoff`. The parameter type is `Reducer<S, M, C>`, whose every cell\n// returns the non-thenable `SyncReturn<S, C>`, so the reentrancy guard fires\n// HERE, at construction: an `async` cell (or one that inline-`await`s) returns\n// `Promise<...>`, which is not assignable to `SyncReturn`, and `tsc` rejects the\n// call at the offending cell. A pure synchronous reducer passes through\n// untouched and gains the phantom `ReducerBrand`.\n//\n// PURE: identity at runtime (the brand is phantom). `defineMachine` brands its\n// `update` internally the same way, so callers that pass an object literal\n// straight to `defineMachine` never need to call `asReducer` — it exists for\n// the standalone `const update = asReducer<...>({ ... })` form, mirroring how a\n// caller can mint an `Rng` with `asRng` before wiring it.\nexport function asReducer<S, M extends { type: string }, C extends Cmd>(\n  reducer: Reducer<S, M, C>,\n): Branded<Reducer<S, M, C>> {\n  return reducer as Branded<Reducer<S, M, C>>;\n}\n\n// === run: implemented in task 2 ===\n//\n// Returns a `Runtime<S, M>` synchronously. Boot (`store?.load()` + `init`) runs\n// asynchronously as the FIRST entry on the serial dispatch tail; every public\n// runtime method (`dispatch`, `stop`, `getState`) awaits the boot phase\n// implicitly through the queue. Failures inside `store.load` propagate via the\n// boot promise — subsequent calls reject/throw with that error. There is no\n// \"synchronous load\" branch because `Store#load` is async by contract.\n//\n// Save-then-effects ordering is structural: every transition mutates state,\n// awaits `store.save(newState)`, then reconciles subscriptions, then runs\n// `interpret` for emitted cmds, then fires external listeners. A throw in any\n// effect phase leaves the persisted state ahead of the host's belief about\n// what executed — the Railway discipline (`tryInterpret` in handlers) makes\n// that safe in practice.\n\n// === CtxArg<Ctx>: the `ctx` field of `run`'s opts, conditionally optional ===\n//\n// A PURE machine reads nothing from `ctx` — its `Ctx` is `NoCtx`\n// (`Record<never, never>`), `Record<string, never>` (the vortex arena grain,\n// #182), or `unknown`. Forcing such a machine to write `ctx: {}` is ceremony\n// for a value the type already pins as empty — the same friction the\n// `Machine.interpret` field removed for cmdless machines. So `ctx` is\n// CONDITIONALLY optional: when the empty object satisfies `Ctx` it may be\n// OMITTED (the runtime defaults it to `{}`), so a pure reducer runs as\n// `run(machine)`; when `Ctx` carries a field a handler reads, `ctx` stays\n// REQUIRED so a context-bearing machine can't silently forget it.\n//\n// `[Record<never, never>] extends [Ctx]` reads as \"is `{}` assignable to\n// `Ctx`\" — true for the context-free shapes above, false for `{ db: … }`. The\n// tuple-wrap disables distributive conditional behavior, the same trick the\n// `Machine.interpret`/`update` fields use. Existing callers that pass `ctx`\n// are unaffected — an optional field still accepts a present value.\nexport type CtxArg<Ctx> = [Record<never, never>] extends [Ctx]\n  ? { ctx?: Ctx }\n  : { ctx: Ctx };\n\nexport function run<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n  E extends { type: string } = never,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: CtxArg<Ctx> & {\n    store?: Store<S>;\n    onError?: OnError;\n    /**\n     * The SEMANTIC event projector (#47). Maps one APPLIED transition `(msg,\n     * state)` to zero-or-more public events of the machine-level union `E`.\n     * Returning `[]` skips the transition (it produced no event the consumer's\n     * `on(type, …)` cares about). This is where a machine maps its PRIVATE Msg\n     * vocabulary (a retry plumbing's `resilient_ok`, a tool loop's\n     * `agent_tool_ok`) to NAMED events — the private names live only inside this\n     * closure and never reach `on`'s `E` surface. Omit → the run has no event\n     * surface (`E = never`) and `on` is uncallable.\n     *\n     * PURE — called inside the dispatch loop on the freshly-folded `(msg,\n     * state)`; it must not read the clock, mutate, or throw (a throw is\n     * isolated like an observer throw, never stranding the transition).\n     */\n    events?: (msg: M, state: S) => readonly E[];\n    /**\n     * Declared policy for when the pure `update` (reducer) throws. The reducer\n     * throw is always surfaced via `onError` (`phase: \"reduce\"`); the strategy\n     * decides what the runtime does next. Defaults to `\"stop\"` — the explicit,\n     * safe choice (surface + halt, never a silent resume). See `Supervision`.\n     */\n    supervision?: Supervision<S, M>;\n    /**\n     * The run-terminality predicate — what makes the run's outcome first-class\n     * (issue #46). Returns `true` for a State the run has finished in (e.g. an\n     * agent's `state.run.phase === \"done\"`). The runtime feeds it to\n     * `Runtime.result()` (the terminal State, or `undefined` in flight) and\n     * `Runtime.done()` (resolves with the terminal State when it first holds).\n     *\n     * PURE — the runtime calls it inside the dispatch loop on the freshly-folded\n     * State; it must not read the clock, mutate, or throw. Omit → the run is\n     * never terminal: `result()` always returns `undefined` and `done()` never\n     * resolves (the right behavior for a machine with no natural completion).\n     */\n    terminal?: (state: S) => boolean;\n    /**\n     * Iteration cap for `idle()`'s quiescence wait. Defaults to 100_000. Test\n     * seam only — lets a livelock test trip the `QuiescenceTimeoutError` reject\n     * path in a handful of iterations instead of 100k. Production code must not\n     * set it.\n     *\n     * @internal test-only\n     */\n    __idleCap?: number;\n  },\n): BootingRuntime<S, M, E> {\n  const { store } = opts;\n  // `ctx` is conditionally optional (see `CtxArg`): a pure machine omits it.\n  // Default the absent/nullish case to an empty object so the augmented-ctx\n  // spread and `init(loaded, ctx)` get a value, never `undefined`. Callers that\n  // pass a real `ctx` (or `ctx: undefined` for a `Ctx = undefined` machine that\n  // ignores it) are unchanged.\n  const ctx = (opts.ctx ?? {}) as Ctx;\n  const idleCap = opts.__idleCap ?? 100_000;\n  // The semantic-event projector (#47). Defaults to \"no events\" — a machine\n  // that wires none has an empty event surface (`E = never`), so `on` is\n  // uncallable and this projector never runs.\n  const projectEvents: (msg: M, state: S) => readonly E[] =\n    opts.events ?? (() => []);\n  // The run-terminality predicate (#46). Defaults to \"never terminal\" so a\n  // machine with no natural completion has a sound `result()`/`done()` (always\n  // undefined / never resolves) rather than a missing one.\n  const isTerminal: (state: S) => boolean = opts.terminal ?? (() => false);\n  // The error sink for paths with no caller to reject at (follow-up dispatch\n  // rejections, the final stop-save). Optional on `run`; when absent we fall\n  // back to `defaultOnError`, which re-throws on a macrotask so the failure\n  // still surfaces. Invariant 6: no silent failures.\n  const onError: OnError = opts.onError ?? defaultOnError;\n  // The sink must itself be total. If a consumer's sink throws, route THAT\n  // throw through `defaultOnError` so a buggy sink can't re-create a silent\n  // failure (or strand a teardown loop).\n  const reportError = (error: unknown, context: RuntimeErrorContext): void => {\n    try {\n      onError(error, context);\n    } catch (sinkError) {\n      defaultOnError(sinkError, context);\n    }\n  };\n  // The declared policy for a reducer throw (ADR 0003 #4). Default `stop`:\n  // surface via `onError` + halt, never a silent resume. Normalized once here\n  // so `stepDispatch` branches on `.strategy` without re-parsing the shorthand.\n  const supervision = normalizeSupervision<S, M>(opts.supervision);\n\n  // Holders are intentionally late-initialized: `state` is set inside the boot\n  // step, which runs as the head of the tail. `getState()` before boot throws.\n  let state: S | undefined;\n  let bootError: unknown = null;\n  let stopped = false;\n\n  const subRegistry = new Map<string, () => void>();\n  const listeners = new Set<() => void>();\n  // Observers receive (msg, state) for every completed, APPLIED transition. The\n  // boot transition has no applied Msg — it is delivered via `onBoot`, not here\n  // — so `msg` is total (`M`, never `null`) (#47). Same throw-isolation\n  // contract as listeners.\n  const observers = new Set<(msg: M, state: S) => void>();\n  // `onBoot` handlers receive the initial State once (#47). The boot case the\n  // old `observe(msg === null)` arm carried lives here now. `booted` flips on\n  // the boot fanout so a handler registered AFTER boot fires immediately with\n  // the captured initial State (never misses it).\n  const bootHandlers = new Set<(state: S) => void>();\n  let booted = false;\n  // Semantic-event handlers, keyed by event `type` (#47). Each `on(type, fn)`\n  // adds `fn` to its type's bucket; the dispatch loop projects each transition\n  // to `E[]` via `projectEvents` and fans each event to its type's handlers.\n  // Stored as `(event: { type: string }) => void` to keep the registry\n  // monomorphic; per-type safety lives at the `on` call site (the handler's `K`\n  // narrows the event via `Extract<E, { type: K }>`).\n  const eventHandlers = new Map<string, Set<(event: E) => void>>();\n  // `done()` waiters (#46): each open `done()` call parks its resolver here.\n  // The first transition that makes `isTerminal(state)` hold drains the set,\n  // resolving every parked promise with the terminal State. A `done()` call\n  // made AFTER the run is already terminal resolves immediately and never\n  // parks (so it can never miss the terminal transition).\n  const doneWaiters = new Set<(state: S) => void>();\n\n  // Port subscriber registry. Keyed by Port reference (NOT name) — port\n  // identity is nominal/by-reference per Elm semantics. Each port can have\n  // many listeners; emissions fan out synchronously to all of them.\n  // `Set<(value: unknown) => void>` is the storage shape; per-port type\n  // safety is enforced at the `subscribePort` / `emit` call sites via the\n  // phantom `__t` field on `Port<T>`.\n  const portRegistry = new Map<Port<unknown>, Set<(value: unknown) => void>>();\n\n  // The `emit` function injected onto ctx. Synchronous fanout — same shape as\n  // `observe`. No-op when the port has no subscribers. Listener throws are\n  // isolated + logged so one bad subscriber does not strand the others.\n  function portEmit<T>(port: Port<T>, value: T): void {\n    const subscribers = portRegistry.get(port as Port<unknown>);\n    if (!subscribers || subscribers.size === 0) return;\n    for (const listener of subscribers) {\n      try {\n        listener(value);\n      } catch (err) {\n        console.error(err);\n      }\n    }\n  }\n\n  // Augmented ctx passed to every Cmd handler. `ctx` is intentionally spread\n  // into a fresh object so handlers receive a Ctx & PortEmitter without\n  // mutating the caller's ctx (which may be shared across runtimes / tests).\n  const augmentedCtx: Ctx & PortEmitter = { ...ctx, emit: portEmit };\n\n  // === update dispatch ===\n  //\n  // The substrate accepts two `update` shapes (see `defineMachine` overloads):\n  //\n  //   1. Reducer:     `{ [msg.type]: (state, msg) => [S, C[]] }`\n  //   2. Transitions: `{ [state.type]: { [msg.type]: (state, msg) => [S, C[]] } }`\n  //\n  // Branch is structural: an object's first inspected handler tells us\n  // flat-vs-nested — if `update[msg.type]` is itself a function it's a\n  // Reducer; if it's an object whose value is a function it's a Transitions\n  // table. No runtime tag added to the Machine — the form is detectable from\n  // the value shape, and the type system guarantees `update` matches one of\n  // the two shapes at the `defineMachine` boundary.\n  //\n  // The form is detected ONCE per `run()` call (here, at runtime setup) and\n  // cached as `updateMode`. The per-dispatch path is then a single branch +\n  // 1-or-2 property lookups — no per-call shape inspection.\n  type CellFn = (state: S, msg: M) => readonly [S, readonly C[]];\n  type ReducerRecord = Reducer<S, M, C>;\n  type TransitionsTable = {\n    [stateType: string]: { [msgType: string]: CellFn };\n  };\n  const updateForm = machine.update;\n  // The form is read ONCE from the `__form` tag `defineMachine` stamped (see\n  // `formOf` / `UpdateForm`); no structural re-derivation here. Cached as\n  // `updateMode`, so the per-dispatch path is a single branch + 1-or-2 property\n  // lookups.\n  const updateMode: UpdateForm = formOf(machine);\n  function applyUpdate(state: S, msg: M): readonly [S, readonly C[]] {\n    if (__DEV__) deepFreeze(state);\n\n    let result: readonly [S, readonly C[]];\n    if (updateMode === \"reducer\") {\n      // Flat record dispatch. Mapped type (`Reducer<S, M, C>`) guarantees\n      // every Msg variant has a handler at the type level; runtime is a\n      // single property lookup with no fallback default branch.\n      const record = updateForm as ReducerRecord;\n      const handler = record[msg.type as M[\"type\"]];\n      result = handler(state, msg as Extract<M, { type: M[\"type\"] }>);\n    } else {\n      // Transitions table dispatch. `state` is constrained to\n      // `{ type: string }` by the `defineMachine` Transitions overload; the\n      // table guarantees every (state.type × msg.type) cell exists at the\n      // type level. Runtime is two property lookups + the call.\n      const table = updateForm as unknown as TransitionsTable;\n      const stateKey = (state as unknown as { type: string }).type;\n      // The Transitions overload guarantees every (state.type × msg.type) cell\n      // exists at the type level; the runtime lookup cannot miss.\n      // biome-ignore lint/style/noNonNullAssertion: the Transitions overload guarantees every (state.type × msg.type) cell exists at the type level; `!` is required under noUncheckedIndexedAccess and cannot miss at runtime\n      const handler = table[stateKey]![msg.type]!;\n      result = handler(state, msg);\n    }\n\n    if (__DEV__) assertPureResult(result, msg.type);\n    return result;\n  }\n\n  // The serial dispatch queue: every step is chained onto `tail`. New dispatch\n  // calls (and re-entrant ones from interpret follow-ups) wait for the\n  // previous step to fully resolve before running their reducer. This is the\n  // single concurrency gate.\n  let tail: Promise<void> = Promise.resolve();\n\n  /**\n   * Reconcile subscriptions against `state`. Called after every save.\n   *\n   * - Same id present in old + new → leave running.\n   * - Removed id → call cleanup. Swallow cleanup throws + `console.error`.\n   * - New id → call subscribe[type]; on success store cleanup. On throw, the\n   *   sub is NOT registered; throw is remembered and re-thrown after the loop\n   *   so all other new subs still register.\n   */\n  function reconcileSubs(): void {\n    if (!machine.subscriptions) return;\n    const desired = machine.subscriptions(state as S);\n    const desiredIds = new Set<string>();\n\n    // Collision assert: within a single desired set, two subs sharing an id\n    // but declaring different types is the silent class of bug that Elm's\n    // sub diffing relies on the user to avoid — we catch it explicitly here.\n    // (Same id + same type within the desired set is a redundant declaration\n    // — harmless, and the `subRegistry.has` check below dedupes it on the\n    // start path. Same id across transitions is the no-churn case the\n    // reconcile pass is designed for and MUST NOT throw.)\n    const desiredTypeById = new Map<string, string>();\n    for (const sub of desired) {\n      const existing = desiredTypeById.get(sub.id);\n      if (existing !== undefined && existing !== sub.type) {\n        throw new Error(\n          `@demlik/tea: Sub.id collision: id=\"${sub.id}\" declared as type=\"${existing}\" and type=\"${sub.type}\"`,\n        );\n      }\n      desiredTypeById.set(sub.id, sub.type);\n    }\n\n    // Removals first — anything in the registry not in `desired` should stop.\n    for (const sub of desired) desiredIds.add(sub.id);\n    for (const [id, cleanup] of subRegistry) {\n      if (!desiredIds.has(id)) {\n        try {\n          cleanup();\n        } catch (err) {\n          console.error(err);\n        }\n        subRegistry.delete(id);\n      }\n    }\n\n    // Additions — anything in `desired` not in the registry should start.\n    let firstStartError: unknown = null;\n    for (const sub of desired) {\n      if (subRegistry.has(sub.id)) continue;\n      const handler = machine.subscribe?.[sub.type as U[\"type\"]];\n      if (!handler) {\n        // No handler for this sub type — programmer error; skip. (TS would\n        // normally forbid this at compile time when `subscribe` is provided\n        // and U has variants, but a runtime guard is cheap.)\n        continue;\n      }\n      try {\n        const cleanup = handler(\n          sub as Extract<U, { type: U[\"type\"] }>,\n          ctx,\n          enqueueDispatch,\n        );\n        subRegistry.set(sub.id, cleanup);\n      } catch (err) {\n        if (firstStartError === null) firstStartError = err;\n        // Do NOT register; continue to next sub so other starts still run.\n      }\n    }\n    if (firstStartError !== null) throw firstStartError;\n  }\n\n  // `interpret` is optional at the type level when `C extends Cmd<never>`\n  // (see `Machine<...>`). The runtime safely defaults a missing map to `{}`\n  // because such a machine never emits cmds — the cmd loop below never\n  // dereferences a handler. The defensive default also guards against a\n  // miswired non-Cmd<never> consumer reaching this code path; the per-cmd\n  // `if (!handler) continue` then preserves invariant-6 forward progress\n  // instead of throwing on `undefined.foo`.\n  type InterpretMap = {\n    [K in C[\"type\"]]: (\n      cmd: Extract<C, { type: K }>,\n      ctx: Ctx & PortEmitter,\n      // biome-ignore lint/suspicious/noConfusingVoidType: an interpret handler returns a follow-up Msg or nothing; `void` permits no-return bodies that `M | undefined` would reject\n    ) => Promise<M | void>;\n  };\n  const interpretMap: InterpretMap =\n    (machine as { interpret?: InterpretMap }).interpret ?? ({} as InterpretMap);\n\n  /**\n   * Run `interpret` for each emitted cmd. Each handler may return a follow-up\n   * Msg — that Msg is enqueued onto the tail (NOT dispatched re-entrantly\n   * inside the current transition).\n   *\n   * Throws propagate to the caller of `step`. The first error stops further\n   * handlers in this transition.\n   */\n  async function runInterpret(cmds: readonly C[]): Promise<void> {\n    for (const cmd of cmds) {\n      const handler = interpretMap[cmd.type as C[\"type\"]];\n      if (!handler) continue;\n      const follow = await handler(\n        cmd as Extract<C, { type: C[\"type\"] }>,\n        augmentedCtx,\n      );\n      if (follow !== undefined && follow !== null) {\n        // Schedule follow-up Msg on the tail. The current step resolves\n        // first; the follow-up runs after, as a fresh transition. The\n        // returned rejection has no caller (the original dispatcher already\n        // resolved), so route it to the error sink instead of swallowing it —\n        // invariant 6: no silent failures. If you want this failure folded\n        // back into state, name a failure Msg via `tryInterpret` (Railway);\n        // the sink is the last-resort observability hook for the rest.\n        enqueueDispatch(follow as M).catch((error: unknown) => {\n          reportError(error, { phase: \"follow-up\" });\n        });\n      }\n    }\n  }\n\n  /**\n   * Fire every external listener. Listener throws are isolated — one bad\n   * listener does not strand the others. This is the dual of cleanup\n   * semantics: the runtime guarantees forward progress for unrelated\n   * observers.\n   */\n  function fireListeners(): void {\n    for (const listener of listeners) {\n      try {\n        listener();\n      } catch (err) {\n        console.error(err);\n      }\n    }\n  }\n\n  /**\n   * Fire every observer with the just-applied msg + post-transition state.\n   * Same throw-isolation contract as `fireListeners`. Called immediately\n   * after `fireListeners` so observers see exactly what subscribers see. Only\n   * called for APPLIED transitions — `msg` is total (the boot case routes to\n   * `fireBoot`, not here) (#47).\n   */\n  function fireObservers(msg: M): void {\n    if (observers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    for (const observer of observers) {\n      try {\n        observer(msg, snapshot);\n      } catch (err) {\n        console.error(err);\n      }\n    }\n  }\n\n  /**\n   * Project the just-applied transition to semantic events and fan each to its\n   * type's `on(...)` handlers (#47). The projector maps the machine's private\n   * Msg vocabulary to public events; a throw in the projector OR a handler is\n   * isolated (errors-are-data) so it never strands the transition. Called right\n   * after `fireObservers` so an `on` handler sees the same post-transition State\n   * an observer would.\n   */\n  function fireEvents(msg: M): void {\n    if (eventHandlers.size === 0 || state === undefined) return;\n    let events: readonly E[];\n    try {\n      events = projectEvents(msg, state);\n    } catch (err) {\n      console.error(err);\n      return;\n    }\n    for (const event of events) {\n      const bucket = eventHandlers.get(event.type);\n      if (bucket === undefined) continue;\n      for (const handler of bucket) {\n        try {\n          handler(event);\n        } catch (err) {\n          console.error(err);\n        }\n      }\n    }\n  }\n\n  /**\n   * Fire every `onBoot` handler with the initial State, ONCE, and flip `booted`\n   * (#47). This carries the case the old `observe(msg === null)` arm did. Same\n   * throw-isolation contract. A handler registered after this runs fires\n   * immediately at its `onBoot` call site instead (it reads `booted`).\n   */\n  function fireBoot(): void {\n    booted = true;\n    if (bootHandlers.size === 0 || state === undefined) return;\n    const snapshot = state;\n    for (const handler of bootHandlers) {\n      try {\n        handler(snapshot);\n      } catch (err) {\n        console.error(err);\n      }\n    }\n  }\n\n  /**\n   * Resolve every parked `done()` waiter iff the just-folded State is terminal\n   * (#46). Called once per completed transition (including boot), right after\n   * the observer fanout, so a `done()` promise settles on the SAME transition a\n   * synchronous `result()` would first return non-`undefined`. Drains the set\n   * before resolving (a resolver enqueued anew during the drain belongs to the\n   * next call, not this one — but a terminal State stays terminal, so the new\n   * waiter's own `done()` call already resolved it immediately).\n   */\n  function settleDoneWaiters(): void {\n    if (doneWaiters.size === 0 || state === undefined) return;\n    if (!isTerminal(state)) return;\n    const snapshot = state;\n    const parked = [...doneWaiters];\n    doneWaiters.clear();\n    for (const resolve of parked) resolve(snapshot);\n  }\n\n  /**\n   * One full transition: update → save → reconcile subs → interpret → fire\n   * listeners. Save-before-effects is the hard ordering; tests pin it.\n   *\n   * Throws from `update` propagate immediately (state unchanged). Throws from\n   * `save` propagate after the in-memory `state` is advanced (PRD row: \"state\n   * advanced; persisted state did not\"). Throws from reconcile or interpret\n   * propagate after `save` has succeeded (PRD row: \"state already saved\").\n   */\n  async function stepDispatch(msg: M): Promise<void> {\n    if (state === undefined) {\n      // This should never happen — boot always runs before any dispatch.\n      throw new Error(\"@demlik/tea: runtime not booted\");\n    }\n    // The reducer is the only synchronous user code in the step, and #71's\n    // brand guarantees it cannot suspend — so a throw here is a clean,\n    // catchable synchronous throw with `state` still at its pre-transition\n    // value. Route it to the declared supervision strategy (ADR 0003 #4).\n    let next: S;\n    let cmds: readonly C[];\n    try {\n      [next, cmds] = applyUpdate(state, msg);\n    } catch (reduceError) {\n      // Invariant 6 — surface the failure as data FIRST, for every strategy.\n      reportError(reduceError, { phase: \"reduce\" });\n      switch (supervision.strategy) {\n        case \"restart\": {\n          // Host supplies last-known-good state; core installs it and KEEPS\n          // FOLDING from there. State did not advance to the (never-produced)\n          // reducer result — it is replaced by the rehydrated value. The\n          // transition continues below with no cmds, since the throwing reduce\n          // produced none. A throw inside `rehydrate` itself is NOT caught here\n          // — it propagates as a genuine recovery failure (the host's\n          // last-good source is broken), surfacing to the dispatch caller.\n          state = supervision.rehydrate(state, msg, reduceError);\n          if (store) await store.save(state);\n          reconcileSubs();\n          // No cmds to interpret — the reducer never returned a result.\n          fireListeners();\n          fireObservers(msg);\n          fireEvents(msg);\n          settleDoneWaiters();\n          return;\n        }\n        case \"escalate\":\n          // Surface + propagate. The runtime stays live (a parent supervisor\n          // may keep dispatching); the failure bubbles out the dispatch\n          // promise so the caller above sees it.\n          throw reduceError;\n        default:\n          // `stop` (the safe default): halt the runtime. State is NOT advanced;\n          // every subsequent dispatch rejects (\"runtime stopped\"). Propagate so\n          // THIS dispatch promise also rejects — the halt is observable, never\n          // a silent resume.\n          stopped = true;\n          throw reduceError;\n      }\n    }\n    state = next;\n    if (store) await store.save(state);\n    // Subscriptions reconcile against the new state; throws propagate AFTER\n    // the entire diff pass completes (so other subs still register / clean\n    // up correctly). Cleanup throws are swallowed inside reconcileSubs.\n    reconcileSubs();\n    await runInterpret(cmds);\n    fireListeners();\n    fireObservers(msg);\n    fireEvents(msg);\n    settleDoneWaiters();\n  }\n\n  /**\n   * Boot is split into two phases.\n   *\n   * - **Synchronous (`run()` call):** when `store` is absent, we know `loaded\n   *   = null` without an await — run `init(null, ctx)` IMMEDIATELY so that\n   *   `getState()` is observable synchronously. This is what\n   *   `useSyncExternalStore` consumers (e.g. `@demlik/tea/react`) need to render\n   *   on the first commit without an undefined-state flicker.\n   * - **Asynchronous (`stepBootEffects` on the tail):** save + sub reconcile\n   *   + interpret-of-init-cmds + listener fire. These run as the first tail\n   *   entry; subsequent dispatches queue behind them.\n   *\n   * When `store` IS present we cannot do `init` synchronously (we'd be\n   *  inventing a loaded value), so we keep the full async path. Components\n   * that want synchronous initial state in that case should omit the store\n   * for the React mount and persist via a different mechanism (or accept the\n   * default-snapshot story in a future v2).\n   *\n   * `store.load` throws propagate via the boot promise; subsequent calls\n   * reject with the load error. (The PRD row \"run() throws synchronously\" is\n   * imprecise relative to Store#load being async — we honor the intent: no\n   * usable runtime is ever observable on load failure.)\n   */\n  // Synchronous init when there is NO store: `getState()` is observable\n  // synchronously by `useSyncExternalStore` consumers. When a store IS\n  // present, `init` must run AFTER `store.load()` (the contract: `init`\n  // receives the loaded snapshot), and callers must await boot before\n  // calling `getState()` — they do so implicitly via the first `dispatch()`\n  // (which queues behind the boot step).\n  //\n  // The asymmetry is the substrate being honest about a real constraint: a\n  // store is, by definition, an async boundary. Components that need\n  // synchronous initial state under a store should await the runtime's boot\n  // before mounting — `await runtime.ready` (not provided in v1; use `await\n  // runtime.dispatch(noopMsg)` if needed, or a parent-level loading state).\n  let pendingInitCmds: readonly C[] = [];\n  if (!store) {\n    const [initialState, initCmds] = machine.init(null, ctx);\n    state = initialState;\n    pendingInitCmds = initCmds;\n  }\n\n  async function stepBootEffects(): Promise<void> {\n    if (store) {\n      // Boundary parse (invariant 8). `store.load()` returns `unknown`\n      // because storage doesn't know `S`; `store.migrate(raw)` is the\n      // substrate's required parse — `S` on recognized shape, `null` on\n      // unrecognized (which boots fresh, a known-good path). `migrate` MUST\n      // NOT throw per its contract; if it does we surface the error via the\n      // boot promise (same as a `load` throw — `runtime.ready` rejects and\n      // every subsequent `dispatch` surfaces `bootError`).\n      const raw = await store.load();\n      const parsed = store.migrate(raw);\n      const [initialState, initCmds] = machine.init(parsed, ctx);\n      state = initialState;\n      pendingInitCmds = initCmds;\n      await store.save(state);\n    }\n    reconcileSubs();\n    await runInterpret(pendingInitCmds);\n    fireListeners();\n    // The boot transition has no applied Msg — deliver the initial State via\n    // `onBoot`, not `observe` (#47). No `fireEvents` either: boot is not an\n    // applied event, so it projects no semantic event.\n    fireBoot();\n    // A rehydrated boot can land in a terminal State (the run finished before\n    // the last eviction) — settle any `done()` waiter parked before boot.\n    settleDoneWaiters();\n  }\n\n  /**\n   * Enqueue a dispatch on the tail. Re-entrant calls from interpret or\n   * subscribe handlers go through this same gate — guaranteeing serial\n   * execution across the entire system.\n   *\n   * `dispatch` rejects when:\n   * - the runtime is stopped (next dispatch always rejects after stop);\n   * - boot failed (every dispatch surfaces the boot error);\n   * - the reducer, save, sub start, or interpret throws.\n   */\n  function enqueueDispatch(msg: M): Promise<void> {\n    if (stopped)\n      return Promise.reject(new Error(\"@demlik/tea: runtime stopped\"));\n    const next = tail.then(() => {\n      if (bootError !== null) throw bootError;\n      return stepDispatch(msg);\n    });\n    // Swallow the rejection on the tail so a single failing dispatch does NOT\n    // poison every subsequent one. The original `next` promise still rejects\n    // for the dispatch caller.\n    tail = next.catch(() => {});\n    return next;\n  }\n\n  /**\n   * Drain the serial tail to quiescence. Quiescence = the tail stopped\n   * advancing: every interpret follow-up calls `enqueueDispatch`, which\n   * reassigns `tail` SYNCHRONOUSLY (before the parent step resolves), so\n   * awaiting the current `tail` and re-reading it catches every transitively\n   * enqueued follow-up. We loop until the reference is stable across an await.\n   *\n   * Bounded by `idleCap` — on cap we REJECT with `QuiescenceTimeoutError`\n   * (never a silent fall-through-resolve), so a livelocking machine stays\n   * distinguishable from a genuinely quiesced one (invariant 6 — issue #51).\n   *\n   * Shared by `runtime.idle()` and the quiescent `dispatch` default (#50): one\n   * drain definition, one cap, one reject contract.\n   */\n  async function drainToQuiescence(): Promise<void> {\n    for (let i = 0; i < idleCap; i++) {\n      const observed = tail;\n      await observed;\n      if (tail === observed) return;\n    }\n    throw new QuiescenceTimeoutError(idleCap);\n  }\n\n  /**\n   * The public `dispatch`: run-to-quiescence by default (#50). Enqueue the Msg\n   * on the tail, await its OWN transition first (so a reducer / save / interpret\n   * throw on THIS Msg surfaces here, before any drain), then — unless the caller\n   * asked for a single step — drain the transitive follow-up chain.\n   *\n   * `{ settle: \"once\" }` (and the `dispatchOnce` alias) skip the drain: resolve\n   * after the one transition and leave the follow-up chain racing on the tail\n   * for a caller that will `await runtime.idle()` itself.\n   */\n  async function dispatchToQuiescence(\n    msg: M,\n    opts?: { readonly settle?: DispatchSettle },\n  ): Promise<void> {\n    await enqueueDispatch(msg);\n    if (opts?.settle === \"once\") return;\n    await drainToQuiescence();\n  }\n\n  // Kick off boot-effects immediately. Boot rejections are remembered on\n  // `bootError`; they surface on every subsequent dispatch call. Note: when\n  // `store` is absent the synchronous-init step above already set `state` —\n  // `stepBootEffects` only runs save/sub/interpret/listener-fire. When\n  // `store` is present, the full async path runs here.\n  //\n  // `bootPromise` is the original (un-swallowed) promise — it is what\n  // `runtime.ready` chains off so callers see the boot error directly. `tail`\n  // gets the swallowed branch so a boot failure does NOT poison every\n  // subsequent dispatch's `.then` chain (each dispatch surfaces `bootError`\n  // explicitly inside `enqueueDispatch`).\n  const bootPromise = stepBootEffects();\n  tail = bootPromise.catch((err) => {\n    bootError = err;\n  });\n\n  // `ready` resolves to the booted `Runtime` (issue #45). It chains off the\n  // un-swallowed `bootPromise` so boot failures reject it directly — meaning a\n  // failed boot never hands out a `Runtime`, which is what keeps `getState()`\n  // total. The `runtime` reference resolves at `.then` time (a later\n  // microtask), well after the object literal below finishes initializing, so\n  // the forward reference is safe. Built once → idempotent: the same settled\n  // promise comes back on every `ready` read.\n  const readyPromise: Promise<Runtime<S, M, E>> = bootPromise.then(\n    () => runtime,\n  );\n\n  const runtime: Runtime<S, M, E> = {\n    dispatch: dispatchToQuiescence,\n    dispatchOnce: enqueueDispatch,\n    getState(): S {\n      // TOTAL (issue #45). A `Runtime` is only obtainable by awaiting `ready`,\n      // which resolves AFTER boot has run `init` and set `state` — so by the\n      // time any holder of this object can call `getState()`, `state` is\n      // defined. No `state === undefined` throw branch: that was the old lie\n      // (declared total on the synchronously-returned handle, threw under a\n      // store pre-boot). Boot failures never reach here either — `ready`\n      // rejects, so no `Runtime` is ever handed out on a failed boot.\n      //\n      // The cast encodes that invariant. The lone way to reach it with `state`\n      // still undefined would be to cast the BootingRuntime to Runtime and call\n      // `getState()` before `ready` — which the type system now forbids without\n      // an explicit, deliberate cast.\n      return state as S;\n    },\n    subscribe(listener: () => void): () => void {\n      listeners.add(listener);\n      return () => {\n        listeners.delete(listener);\n      };\n    },\n    observe(observer: (msg: M, state: S) => void): () => void {\n      observers.add(observer);\n      return () => {\n        observers.delete(observer);\n      };\n    },\n    onBoot(handler: (state: S) => void): () => void {\n      // Already booted → fire immediately with the captured initial State so a\n      // late subscriber never misses the one-shot boot (#47). It does not park\n      // (boot is a single past event), so the returned cleanup is a no-op.\n      if (booted && state !== undefined) {\n        try {\n          handler(state);\n        } catch (err) {\n          console.error(err);\n        }\n        return () => {};\n      }\n      bootHandlers.add(handler);\n      return () => {\n        bootHandlers.delete(handler);\n      };\n    },\n    on<K extends E[\"type\"]>(\n      type: K,\n      handler: (event: Extract<E, { type: K }>) => void,\n    ): () => void {\n      // The registry is monomorphic (`Set<(event: E) => void>`); the per-type\n      // narrowing lives at THIS call site — `handler` accepts the `K`-narrowed\n      // event, and `fireEvents` only ever routes an event to its own type's\n      // bucket, so the erased call is sound.\n      let bucket = eventHandlers.get(type);\n      if (bucket === undefined) {\n        bucket = new Set<(event: E) => void>();\n        eventHandlers.set(type, bucket);\n      }\n      const erased = handler as (event: E) => void;\n      bucket.add(erased);\n      return () => {\n        const set = eventHandlers.get(type);\n        if (set === undefined) return;\n        set.delete(erased);\n        if (set.size === 0) eventHandlers.delete(type);\n      };\n    },\n    subscribePort<T>(port: Port<T>, listener: (value: T) => void): () => void {\n      const key = port as Port<unknown>;\n      let bucket = portRegistry.get(key);\n      if (!bucket) {\n        bucket = new Set<(value: unknown) => void>();\n        portRegistry.set(key, bucket);\n      }\n      // The bucket stores `(value: unknown) => void` to keep the registry\n      // monomorphic; per-port type safety lives at this call site (the\n      // listener's `T` is bound to the port's phantom `__t`).\n      const erased = listener as (value: unknown) => void;\n      bucket.add(erased);\n      return () => {\n        const set = portRegistry.get(key);\n        if (!set) return;\n        set.delete(erased);\n        if (set.size === 0) portRegistry.delete(key);\n      };\n    },\n    emitPort<T>(port: Port<T>, value: T): void {\n      // Same closure as `ctx.emit` inside interpret — synchronous fanout,\n      // no-op on no subscribers, listener-throw isolation. Exposing it on\n      // the Runtime interface lets `observe`-driven Port emission work\n      // without spawning a \"tell the outside world\" Cmd per transition.\n      portEmit(port, value);\n    },\n    // `ready` is assigned just below (it must resolve to `runtime` itself,\n    // which can't be referenced inside its own object literal). See the\n    // assignment + rationale after this block.\n    ready: readyPromise,\n    idle(): Promise<void> {\n      // Quiescence = the tail stopped advancing (full rationale on\n      // `drainToQuiescence`). `idle()` is the direct await of that drain; the\n      // quiescent `dispatch` default reuses the SAME helper after its own\n      // transition. The cap + `QuiescenceTimeoutError` reject (no silent\n      // fall-through-resolve) keeps \"quiesced\" and \"gave up\" distinguishable —\n      // invariant 6: no silent failures.\n      return drainToQuiescence();\n    },\n    result(): S | undefined {\n      // TOTAL — `state` is defined for any holder of a `Runtime` (see\n      // `getState`). The terminal predicate is the ONLY thing that decides\n      // \"finished\"; with none supplied `isTerminal` is `() => false`, so a\n      // non-terminating machine reads `undefined` forever (#46).\n      const current = state as S;\n      return isTerminal(current) ? current : undefined;\n    },\n    done(): Promise<S> {\n      // Already terminal → resolve at once with the live State (never parks, so\n      // a post-termination call can't miss the terminal transition).\n      const current = state as S;\n      if (isTerminal(current)) return Promise.resolve(current);\n      // Otherwise park a resolver; `settleDoneWaiters` drains it on the\n      // transition that first makes `isTerminal` hold. With no predicate this\n      // promise never resolves — the documented \"no natural completion\" case.\n      return new Promise<S>((resolve) => {\n        doneWaiters.add(resolve);\n      });\n    },\n    async stop(): Promise<void> {\n      stopped = true;\n      // Drain whatever is in flight before tearing down. Any rejections in\n      // the tail were already swallowed at enqueue time, so this await\n      // always resolves.\n      await tail;\n      // Run every active sub cleanup. Throws are swallowed + logged so one\n      // bad cleanup does not strand the others.\n      for (const [id, cleanup] of subRegistry) {\n        try {\n          cleanup();\n        } catch (err) {\n          console.error(err);\n        }\n        subRegistry.delete(id);\n      }\n      // Flush final state. A save throw here does not reject `stop()` — the\n      // contract is \"returns a resolved Promise\" — but it IS the loss of the\n      // last write, so route it to the error sink rather than swallowing it\n      // with a bare console.error. Invariant 6: no silent failures.\n      if (store && state !== undefined && bootError === null) {\n        try {\n          await store.save(state);\n        } catch (error) {\n          reportError(error, { phase: \"stop-save\" });\n        }\n      }\n    },\n  };\n\n  return runtime;\n}\n\n// === historyTracker: composable observability helper ===\n//\n// A bounded ring buffer of recent `(msg, state)` transitions, built on the\n// Runtime's public `observe` API. The substrate itself stays minimal — it\n// has no notion of history, no opt to enable one, no method on the Runtime\n// interface to read one. Anything that wants \"recent transitions\" composes\n// via this helper. The substrate provides the primitive (`observe`); this\n// is the bookkeeping that builds on it.\n//\n// Use cases:\n//   - Bridge backlog replay for late subscribers (see `@demlik/tea/extension`).\n//   - Debug inspectors showing recent traffic on attach.\n//   - Sentry breadcrumb collection.\n//   - Property/contract tests that want to assert \"these N transitions\n//     happened in this order.\"\n//\n// Discipline:\n//   - One-line creation: `const tr = historyTracker(runtime, 100);`\n//   - Snapshot at any time: `tr.snapshot()` — shallow copy, oldest first.\n//   - Detach when done: `tr.stop()` — unsubscribes the observer; the buffer\n//     freezes at its current contents (snapshot() still works, useful for\n//     post-hoc inspection in tests).\n//\n// Why not put this on the Runtime interface as `runtime.history()`?\n// Because history is derivable. Putting it on the Runtime privileges one\n// use case (debug inspectors) at the substrate level and grows the\n// interface for everyone. The composition shape stays out of the dispatch\n// loop entirely — the substrate's hot path doesn't pay any cost for a\n// feature it doesn't need to provide.\n// =============================================================================\n\nexport interface HistoryTracker<S, M extends { type: string }> {\n  /**\n   * Snapshot of recorded transitions, oldest first. Each entry is\n   * `{ msg, state }` exactly as the underlying `observe` callback received\n   * it — `msg` is `null` for the boot transition, a Msg for every other.\n   *\n   * Returns a shallow copy: the array is fresh on every call (callers may\n   * iterate, slice, or replay without affecting the tracker's buffer).\n   * Entry values are references to the originals (TEA states/msgs are\n   * conventionally immutable; do not mutate them if your S/M is not).\n   */\n  snapshot(): readonly { readonly msg: M | null; readonly state: S }[];\n  /**\n   * Detach the underlying observer. After `stop()`:\n   *   - No new transitions are recorded.\n   *   - `snapshot()` continues to work and returns the buffer's contents\n   *     at the moment of stop (useful for post-hoc inspection in tests).\n   *   - The tracker holds no references that would prevent GC of the\n   *     `runtime` argument other than the entries already buffered.\n   *\n   * Idempotent — subsequent calls are no-ops.\n   */\n  stop(): void;\n}\n\n/**\n * Create a bounded history tracker over a Runtime. The tracker subscribes\n * to the runtime via `observe(...)` and retains the last `size` `(msg,\n * state)` transitions in a FIFO ring buffer.\n *\n * @param runtime  Any `BootingRuntime<S, M>` (a full `Runtime` satisfies it).\n *                 The tracker uses only `observe`, which is total before boot —\n *                 attach it to the synchronous `run()` handle to record the\n *                 boot transition.\n * @param size     Buffer cap. `size <= 0` produces an inert no-op tracker:\n *                 no observer is attached to the runtime, `snapshot()` is\n *                 always `[]`, and `stop()` is a no-op. (Prefer skipping the\n *                 tracker entirely in that case — this arm just makes a\n *                 non-positive `size` harmless rather than an error.)\n *\n * Memory cost: O(size × avg(msg + state size)). For audit-extension's\n * inspector use case (size 100, audit state ~5KB), ~500KB max — held\n * in-memory only, no persistence.\n */\nexport function historyTracker<S, M extends { type: string }>(\n  runtime: BootingRuntime<S, M>,\n  size: number,\n): HistoryTracker<S, M> {\n  const buffer: { msg: M | null; state: S }[] = [];\n  let stopped = false;\n\n  const push = (entry: { msg: M | null; state: S }): void => {\n    buffer.push(entry);\n    if (buffer.length > size) buffer.shift();\n  };\n\n  // The boot transition (the `{ msg: null, state }` head entry the old\n  // `observe(msg === null)` arm recorded) now arrives via `onBoot` (#47);\n  // applied transitions arrive via `observe` with a total `msg`. The public\n  // snapshot shape (`msg: M | null`) is unchanged — boot is still `msg: null`.\n  const unobserve =\n    size <= 0\n      ? (): void => {}\n      : runtime.observe((msg, state) => {\n          push({ msg, state });\n        });\n  const unboot =\n    size <= 0\n      ? (): void => {}\n      : runtime.onBoot((state) => {\n          push({ msg: null, state });\n        });\n\n  return {\n    snapshot() {\n      // Shallow copy — callers may freely iterate or mutate the returned\n      // array. Entry values are references; see HistoryTracker docs.\n      return buffer.slice();\n    },\n    stop() {\n      if (stopped) return;\n      stopped = true;\n      unobserve();\n      unboot();\n    },\n  };\n}\n\n// === replay: pure unit-test helper ===\n//\n// Composes `init(loaded ?? null, ctx)` then `update(state, msg)` for each msg.\n// Returns the final state plus the cmds that *would* have been emitted and the\n// subs that *would* have been desired at the final state.\n//\n// Crucially:\n// - does NOT call any `interpret[type]` handler\n// - does NOT touch `Store`\n// - does NOT start any subscription via `machine.subscribe?.[type]`\n//\n// `subscriptions` (the description function) IS called to derive the returned\n// `subs` array. That's intentional — it lets tests assert what would be wired\n// up without actually wiring it.\nexport function replay<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  machine: Machine<S, M, C, U, Ctx>,\n  opts: { msgs: readonly M[]; ctx: Ctx; loaded?: S | null },\n): { state: S; cmds: C[]; subs: U[] } {\n  // `init` is `(loaded: S | null, ctx) => ...`; coerce undefined → null so the\n  // AC \"`replay` with `loaded: undefined` calls `init(null, ctx)`\" holds.\n  const loaded = opts.loaded ?? null;\n  const [initialState, initCmds] = machine.init(loaded, opts.ctx);\n\n  if (loaded !== null && initCmds.length > 0) {\n    throw new Error(\n      \"TEA contract violation: machine.init must return [state, []] (no Cmds) \" +\n        \"when `loaded` is non-null. Init's rehydrate branch is a pure state \" +\n        \"passthrough — the migration/parse boundary, not the boot-effect hook.\\n\\n\" +\n        \"Routes for boot effects:\\n\" +\n        \"  - Stateless infrastructure (e.g. chrome.alarms ensure) → host module \" +\n        \"top level, outside TEA.\\n\" +\n        \"  - State-conditional resume (e.g. re-attach a session) → a `boot` Msg \" +\n        \"dispatched once from the host after `run(...)` returns, handled in update.\\n\\n\" +\n        \"See .patterns/tea/tea-invariants.md (Invariant 2).\",\n    );\n  }\n\n  // `replay` and `foldMsgs` share ONE internal fold (`foldUpdates`), keyed on\n  // `formOf` — the same reader `run` uses — so all three agree on the\n  // reducer-vs-transitions form by construction. `replay` wraps it with the\n  // `init` entry + Cmd/Sub collection; `foldMsgs` calls it from a base state\n  // and returns the state only.\n  const { state, cmds: foldedCmds } = foldUpdates<S, M, C>(\n    machine,\n    initialState,\n    opts.msgs,\n  );\n  const cmds: C[] = [...initCmds, ...foldedCmds];\n\n  const subs: U[] = machine.subscriptions\n    ? [...machine.subscriptions(state)]\n    : [];\n\n  return { state, cmds, subs };\n}\n\n// === tryInterpret: Railway sugar over `Result.tryPromise` ===\n//\n// Wraps a fallible `(cmd, ctx) => Promise<Ok>` and returns a handler suitable\n// for `interpret[type]`. On success the returned function resolves with\n// `onOk(value, cmd)`; on rejection it resolves with `onErr(error, cmd)`. It\n// NEVER rejects (assuming `onOk`/`onErr` are total — that's the caller's\n// contract).\n//\n// Implementation note: we use the `{try, catch: (e) => e}` form of\n// `Result.tryPromise` rather than the one-arg `(thunk)` form so the original\n// error passes through untouched. The one-arg form wraps errors in\n// `UnhandledException`, which would prevent callers from `instanceof`-checking\n// their own error types inside `onErr`.\n//\n// M is a Msg type (not a Cmd) — the helper routes Ok/Err to two Msg constructors.\nexport function tryInterpret<C extends Cmd, Ok, M, Ctx>(\n  work: (cmd: C, ctx: Ctx) => Promise<Ok>,\n  onOk: (value: Ok, cmd: C) => M,\n  onErr: (error: unknown, cmd: C) => M,\n): (cmd: C, ctx: Ctx) => Promise<M> {\n  return async (cmd, ctx) => {\n    const result = await Result.tryPromise({\n      try: () => work(cmd, ctx),\n      catch: (error: unknown): unknown => error,\n    });\n    return result.match({\n      ok: (value) => onOk(value, cmd),\n      err: (error) => onErr(error, cmd),\n    });\n  };\n}\n"]}

package/dist/chunk-2YOE5PIS.js

@@ -0,0 +1,45 @@
+// src/rate-limit/index.ts
+function initBucket(capacity, refillPerSec, nowMs) {
+  return {
+    tokens: capacity,
+    capacity,
+    refillPerSec,
+    lastRefillMs: nowMs
+  };
+}
+function refill(bucket, nowMs) {
+  const elapsedSec = Math.max(0, nowMs - bucket.lastRefillMs) / 1e3;
+  const replenished = bucket.tokens + elapsedSec * bucket.refillPerSec;
+  return {
+    ...bucket,
+    tokens: Math.min(bucket.capacity, replenished),
+    lastRefillMs: nowMs
+  };
+}
+function tryConsume(bucket, nowMs, n = 1) {
+  const refilled = refill(bucket, nowMs);
+  if (refilled.tokens >= n) {
+    return [{ ...refilled, tokens: refilled.tokens - n }, true];
+  }
+  return [refilled, false];
+}
+function initWindow(windowMs, limit) {
+  return { hits: [], windowMs, limit };
+}
+function record(window, nowMs) {
+  const cutoff = nowMs - window.windowMs;
+  const pruned = window.hits.filter((t) => t > cutoff);
+  if (pruned.length < window.limit) {
+    return [{ ...window, hits: [...pruned, nowMs] }, true];
+  }
+  return [{ ...window, hits: pruned }, false];
+}
+function remaining(window, nowMs) {
+  const cutoff = nowMs - window.windowMs;
+  const live = window.hits.filter((t) => t > cutoff).length;
+  return Math.max(0, window.limit - live);
+}
+
+export { initBucket, initWindow, record, refill, remaining, tryConsume };
+//# sourceMappingURL=chunk-2YOE5PIS.js.map
+//# sourceMappingURL=chunk-2YOE5PIS.js.map

package/dist/chunk-2YOE5PIS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/rate-limit/index.ts"],"names":[],"mappings":";AAsDO,SAAS,UAAA,CACd,QAAA,EACA,YAAA,EACA,KAAA,EACa;AACb,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,QAAA;AAAA,IACR,QAAA;AAAA,IACA,YAAA;AAAA,IACA,YAAA,EAAc;AAAA,GAChB;AACF;AAcO,SAAS,MAAA,CAAO,QAAqB,KAAA,EAA4B;AACtE,EAAA,MAAM,aAAa,IAAA,CAAK,GAAA,CAAI,GAAG,KAAA,GAAQ,MAAA,CAAO,YAAY,CAAA,GAAI,GAAA;AAC9D,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,GAAS,UAAA,GAAa,MAAA,CAAO,YAAA;AACxD,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,UAAU,WAAW,CAAA;AAAA,IAC7C,YAAA,EAAc;AAAA,GAChB;AACF;AAeO,SAAS,UAAA,CACd,MAAA,EACA,KAAA,EACA,CAAA,GAAI,CAAA,EAC6B;AACjC,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,KAAK,CAAA;AACrC,EAAA,IAAI,QAAA,CAAS,UAAU,CAAA,EAAG;AACxB,IAAA,OAAO,CAAC,EAAE,GAAG,QAAA,EAAU,QAAQ,QAAA,CAAS,MAAA,GAAS,CAAA,EAAE,EAAG,IAAI,CAAA;AAAA,EAC5D;AACA,EAAA,OAAO,CAAC,UAAU,KAAK,CAAA;AACzB;AAqBO,SAAS,UAAA,CAAW,UAAkB,KAAA,EAA8B;AACzE,EAAA,OAAO,EAAE,IAAA,EAAM,EAAC,EAAG,UAAU,KAAA,EAAM;AACrC;AAgBO,SAAS,MAAA,CACd,QACA,KAAA,EACmC;AACnC,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,CAAO,QAAA;AAC9B,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAA,KAAM,IAAI,MAAM,CAAA;AACnD,EAAA,IAAI,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,KAAA,EAAO;AAChC,IAAA,OAAO,CAAC,EAAE,GAAG,MAAA,EAAQ,IAAA,EAAM,CAAC,GAAG,MAAA,EAAQ,KAAK,CAAA,EAAE,EAAG,IAAI,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,CAAC,EAAE,GAAG,QAAQ,IAAA,EAAM,MAAA,IAAU,KAAK,CAAA;AAC5C;AAQO,SAAS,SAAA,CAAU,QAAuB,KAAA,EAAuB;AACtE,EAAA,MAAM,MAAA,GAAS,QAAQ,MAAA,CAAO,QAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAO,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,GAAI,MAAM,CAAA,CAAE,MAAA;AACnD,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,MAAA,CAAO,QAAQ,IAAI,CAAA;AACxC","file":"chunk-2YOE5PIS.js","sourcesContent":["/**\n * @demlik/tea/rate-limit — two rate limiters as pure state + ops.\n *\n * Same shape as `@demlik/tea/work-queue`'s `ops.ts`: a state type plus pure\n * transition functions. Host-agnostic by construction — no `Date.now()`, no\n * timers, no I/O. The caller injects the clock (`nowMs`) and wires the result\n * into its own reducer / interpret. This keeps the limiters inside TEA's\n * invariant 2 (transitions are pure: same inputs → same outputs, no `Date.now`)\n * so a consumer can fold them through `update` and exercise them with `replay`\n * / the pbt fold without a fake clock.\n *\n * Every op returns a NEW state value and never mutates its input (invariant 1 —\n * state is a value, not a place). The `tryConsume` / `record` ops return a\n * `[next, ok]` tuple so the caller branches on the decision while threading the\n * advanced state forward; `refill` / `remaining` are read-shaped helpers.\n *\n * Two complementary algorithms, picked by the cost the caller wants to pay:\n *\n *   - **Token bucket** — O(1) state (four numbers), smooths bursts against a\n *     steady refill rate. Allows a burst up to `capacity`, then throttles to\n *     `refillPerSec`. Cheapest; the default choice.\n *   - **Sliding window log** — O(limit) state (one timestamp per in-window\n *     hit), exact \"no more than `limit` events per `windowMs`\". Pay the memory\n *     for precise window edges when a token bucket's continuous refill would\n *     let through too many at a boundary.\n *\n * NOT exported from the package root — reached via the `@demlik/tea/rate-limit`\n * subpath, same one-shape-per-package rule as `work-queue` and `do`.\n */\n\n// ===========================================================================\n// Token bucket\n// ===========================================================================\n\n/**\n * A token bucket: `tokens` of `capacity` available now, replenished at\n * `refillPerSec` tokens per second. `lastRefillMs` is the clock reading at\n * which `tokens` was last computed — `refill` advances it. All four fields are\n * plain numbers so the whole bucket is trivially JSON-serializable into a\n * consumer's `Store<S>`.\n */\nexport interface TokenBucket {\n  readonly tokens: number;\n  readonly capacity: number;\n  readonly refillPerSec: number;\n  readonly lastRefillMs: number;\n}\n\n/**\n * Create a full bucket. Starts at `capacity` tokens (the conventional \"a fresh\n * limiter lets the first burst through\" behavior) and stamps `lastRefillMs`\n * with the caller's clock so the first `refill` measures elapsed time from\n * boot, not from epoch 0.\n */\nexport function initBucket(\n  capacity: number,\n  refillPerSec: number,\n  nowMs: number,\n): TokenBucket {\n  return {\n    tokens: capacity,\n    capacity,\n    refillPerSec,\n    lastRefillMs: nowMs,\n  };\n}\n\n/**\n * Add the tokens accrued since `lastRefillMs`, clamped to `capacity`, and\n * advance `lastRefillMs` to `nowMs`. PURE — returns a new bucket; the input is\n * untouched.\n *\n * A `nowMs` at or before `lastRefillMs` (clock not advanced, or skewed\n * backwards) adds a non-positive amount; `Math.max(0, …)` floors the elapsed\n * term so a backwards clock can never *remove* tokens. `lastRefillMs` still\n * advances to `nowMs` so the bucket tracks the latest reading the caller\n * presented — the next forward step measures from there, not from a stale\n * future timestamp.\n */\nexport function refill(bucket: TokenBucket, nowMs: number): TokenBucket {\n  const elapsedSec = Math.max(0, nowMs - bucket.lastRefillMs) / 1000;\n  const replenished = bucket.tokens + elapsedSec * bucket.refillPerSec;\n  return {\n    ...bucket,\n    tokens: Math.min(bucket.capacity, replenished),\n    lastRefillMs: nowMs,\n  };\n}\n\n/**\n * Refill against `nowMs`, then attempt to take `n` tokens (default 1).\n *\n * On success returns `[next, true]` with `n` subtracted; on failure returns\n * `[refilled, false]` — the refilled bucket (so the caller keeps the advanced\n * clock + accrued tokens) with no tokens spent. Branch on the boolean, thread\n * the bucket forward regardless:\n *\n *   const [b1, ok] = tryConsume(bucket, nowMs);\n *   return ok ? [{ ...state, bucket: b1 }, [doWork]] : [{ ...state, bucket: b1 }, []];\n *\n * PURE — input bucket is never mutated.\n */\nexport function tryConsume(\n  bucket: TokenBucket,\n  nowMs: number,\n  n = 1,\n): readonly [TokenBucket, boolean] {\n  const refilled = refill(bucket, nowMs);\n  if (refilled.tokens >= n) {\n    return [{ ...refilled, tokens: refilled.tokens - n }, true];\n  }\n  return [refilled, false];\n}\n\n// ===========================================================================\n// Sliding window log\n// ===========================================================================\n\n/**\n * A sliding-window log: the timestamps of every hit still inside the trailing\n * `windowMs`, capped at `limit` events per window. `hits` is `readonly` and\n * kept oldest-first (pruning slices the stale prefix off the front, recording\n * appends to the back), so the array is its own sorted index. Exact at the\n * window edge — unlike a token bucket's continuous refill, a hit leaves the\n * count the instant it ages past `windowMs`.\n */\nexport interface SlidingWindow {\n  readonly hits: readonly number[];\n  readonly windowMs: number;\n  readonly limit: number;\n}\n\n/** Create an empty window. No hits recorded yet. */\nexport function initWindow(windowMs: number, limit: number): SlidingWindow {\n  return { hits: [], windowMs, limit };\n}\n\n/**\n * Prune hits older than `nowMs - windowMs`, then record `nowMs` if there is\n * room. Returns `[next, true]` with the hit appended when `hits.length < limit`\n * after pruning, else `[pruned, false]` — the pruned window (capacity recovers\n * as old hits age out) with nothing appended.\n *\n * The cutoff is half-open: a hit exactly `windowMs` old is pruned (`<= cutoff`\n * drops it), so a hit recorded at `t` no longer counts at `t + windowMs`. That\n * makes the window's capacity fully recover `windowMs` after the last hit, the\n * behavior tests pin.\n *\n * PURE — input window is never mutated; `hits` is rebuilt by `filter` +\n * spread.\n */\nexport function record(\n  window: SlidingWindow,\n  nowMs: number,\n): readonly [SlidingWindow, boolean] {\n  const cutoff = nowMs - window.windowMs;\n  const pruned = window.hits.filter((t) => t > cutoff);\n  if (pruned.length < window.limit) {\n    return [{ ...window, hits: [...pruned, nowMs] }, true];\n  }\n  return [{ ...window, hits: pruned }, false];\n}\n\n/**\n * How many more hits `record` would accept at `nowMs` without blocking —\n * `limit` minus the live (post-prune) hit count, floored at 0. Read-only: it\n * prunes a local copy to answer but returns no new window. Use it to render a\n * \"N requests remaining\" affordance without committing a hit.\n */\nexport function remaining(window: SlidingWindow, nowMs: number): number {\n  const cutoff = nowMs - window.windowMs;\n  const live = window.hits.filter((t) => t > cutoff).length;\n  return Math.max(0, window.limit - live);\n}\n"]}

package/dist/chunk-3545BOYL.js

@@ -0,0 +1,65 @@
+// src/do/durable-effects.ts
+function emptyLedger() {
+  return /* @__PURE__ */ new Map();
+}
+function applyEffectEvent(ledger, event) {
+  const next = new Map(ledger);
+  switch (event.type) {
+    case "effect_owed":
+      next.set(event.id, event.effect);
+      return next;
+    case "effect_confirmed":
+      next.delete(event.id);
+      return next;
+  }
+}
+function foldLedger(events) {
+  let ledger = emptyLedger();
+  for (const event of events) ledger = applyEffectEvent(ledger, event);
+  return ledger;
+}
+function survivingEffects(ledger) {
+  const out = [];
+  for (const [id, effect] of ledger) out.push({ id, effect });
+  return out;
+}
+function isOwed(ledger, id) {
+  return ledger.has(id);
+}
+function pendingEffectsLedger(restore) {
+  let mirror = restore?.events ? foldLedger(restore.events) : emptyLedger();
+  let counter = restore?.lastId ?? 0;
+  if (restore?.lastId === void 0 && restore?.events) {
+    for (const e of restore.events) if (e.id > counter) counter = e.id;
+  } else if (restore?.lastId === void 0) {
+    for (const id of mirror.keys()) if (id > counter) counter = id;
+  }
+  return {
+    owe(effect) {
+      counter += 1;
+      const id = counter;
+      const event = { type: "effect_owed", id, effect };
+      mirror = applyEffectEvent(mirror, event);
+      return { id, event };
+    },
+    confirm(id) {
+      const confirmed = mirror.has(id);
+      const event = { type: "effect_confirmed", id };
+      mirror = applyEffectEvent(mirror, event);
+      return { confirmed, event };
+    },
+    surviving() {
+      return survivingEffects(mirror);
+    },
+    ledger() {
+      return mirror;
+    },
+    lastId() {
+      return counter;
+    }
+  };
+}
+
+export { applyEffectEvent, emptyLedger, foldLedger, isOwed, pendingEffectsLedger, survivingEffects };
+//# sourceMappingURL=chunk-3545BOYL.js.map
+//# sourceMappingURL=chunk-3545BOYL.js.map

package/dist/chunk-3545BOYL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/do/durable-effects.ts"],"names":[],"mappings":";AA+GO,SAAS,WAAA,GAA0C;AACxD,EAAA,2BAAW,GAAA,EAAmB;AAChC;AAcO,SAAS,gBAAA,CACd,QACA,KAAA,EACyB;AACzB,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,MAAM,CAAA;AAC3B,EAAA,QAAQ,MAAM,IAAA;AAAM,IAClB,KAAK,aAAA;AACH,MAAA,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,EAAA,EAAI,KAAA,CAAM,MAAM,CAAA;AAC/B,MAAA,OAAO,IAAA;AAAA,IACT,KAAK,kBAAA;AACH,MAAA,IAAA,CAAK,MAAA,CAAO,MAAM,EAAE,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA;AAEb;AAWO,SAAS,WACd,MAAA,EACyB;AACzB,EAAA,IAAI,SAAS,WAAA,EAAe;AAC5B,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,EAAQ,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACnE,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,iBACd,MAAA,EAC0B;AAC1B,EAAA,MAAM,MAAuB,EAAC;AAC9B,EAAA,KAAA,MAAW,CAAC,EAAA,EAAI,MAAM,CAAA,IAAK,MAAA,MAAY,IAAA,CAAK,EAAE,EAAA,EAAI,MAAA,EAAQ,CAAA;AAC1D,EAAA,OAAO,GAAA;AACT;AAGO,SAAS,MAAA,CACd,QACA,EAAA,EACS;AACT,EAAA,OAAO,MAAA,CAAO,IAAI,EAAE,CAAA;AACtB;AAsDO,SAAS,qBAAwB,OAAA,EAGV;AAC5B,EAAA,IAAI,SAAkC,OAAA,EAAS,MAAA,GAC3C,WAAW,OAAA,CAAQ,MAAM,IACzB,WAAA,EAAe;AAKnB,EAAA,IAAI,OAAA,GAAU,SAAS,MAAA,IAAU,CAAA;AACjC,EAAA,IAAI,OAAA,EAAS,MAAA,KAAW,MAAA,IAAa,OAAA,EAAS,MAAA,EAAQ;AACpD,IAAA,KAAA,MAAW,CAAA,IAAK,QAAQ,MAAA,EAAQ,IAAI,EAAE,EAAA,GAAK,OAAA,YAAmB,CAAA,CAAE,EAAA;AAAA,EAClE,CAAA,MAAA,IAAW,OAAA,EAAS,MAAA,KAAW,MAAA,EAAW;AACxC,IAAA,KAAA,MAAW,MAAM,MAAA,CAAO,IAAA,IAAQ,IAAI,EAAA,GAAK,SAAS,OAAA,GAAU,EAAA;AAAA,EAC9D;AAEA,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,IAAW,CAAA;AACX,MAAA,MAAM,EAAA,GAAK,OAAA;AACX,MAAA,MAAM,KAAA,GAAuB,EAAE,IAAA,EAAM,aAAA,EAAe,IAAI,MAAA,EAAO;AAC/D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,IAAI,KAAA,EAAM;AAAA,IACrB,CAAA;AAAA,IACA,QAAQ,EAAA,EAAI;AACV,MAAA,MAAM,SAAA,GAAY,MAAA,CAAO,GAAA,CAAI,EAAE,CAAA;AAC/B,MAAA,MAAM,KAAA,GAAyB,EAAE,IAAA,EAAM,kBAAA,EAAoB,EAAA,EAAG;AAC9D,MAAA,MAAA,GAAS,gBAAA,CAAiB,QAAQ,KAAK,CAAA;AACvC,MAAA,OAAO,EAAE,WAAW,KAAA,EAAM;AAAA,IAC5B,CAAA;AAAA,IACA,SAAA,GAAY;AACV,MAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,IAChC,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAA,GAAS;AACP,MAAA,OAAO,OAAA;AAAA,IACT;AAAA,GACF;AACF","file":"chunk-3545BOYL.js","sourcesContent":["/**\n * @demlik/tea/do — the durable pending-effects ledger (substrate primitive #1).\n *\n * Durable *state* and durable *effects* are different problems. An\n * event-sourced actor rebuilds its STATE by folding the event log\n * (`doEventSourcedStore`, sibling file). But an outbound side effect — a tool\n * round-trip, a message to a sibling grain — is fire-and-forget: if the actor\n * interprets the `Cmd` inside an activation that hibernates mid-flight, the\n * effect is lost, yet nothing in the replayed state records that it is still\n * OWED. This is the one real tax of the event-sourced-virtual-actor target\n * (ADR 0003 primitive #1): \"I owe this effect\" must itself be part of the\n * folded state.\n *\n * Akka's classic `AtLeastOnceDelivery` solves it with a ledger of unconfirmed\n * deliveries kept AS PART OF the persisted state: each `deliver` adds an entry\n * keyed by a monotonic `deliveryId`; each `confirmDelivery` removes it. On\n * recovery the ledger is rebuilt from the SAME events, and any surviving entry\n * is re-sent. At-least-once ⇒ a confirmed-but-not-yet-persisted delivery WILL\n * be re-sent after a crash, so the receiver must deduplicate by id.\n *\n * ## The load-bearing rule (do not violate)\n *\n * The ledger is a PURE FOLD over the same kind of event stream the actor\n * already replays — it is **NOT** a separately-persisted side table:\n *\n *   - `effect_owed`     — `{ id, effect }` ADDS an entry to the ledger.\n *   - `effect_confirmed`— `{ id }`         REMOVES the entry.\n *\n * `foldLedger(events)` is `events.reduce(applyEffectEvent, empty())` — the same\n * fold shape `replay` / `foldEvents` / the recorder use. Persist these two\n * events into the SAME log `doEventSourcedStore` already appends (they are just\n * Msg variants), and the ledger is rebuilt for free on the next activation:\n * `foldLedger(log)` after eviction equals `foldLedger(log)` never-evicted, by\n * construction (a pure fold over identical input).\n *\n * On activation (replay completion), `survivingEffects(ledger)` returns the\n * owed-but-unconfirmed entries to re-fire, ordered by their monotonic id. The\n * re-fire is a SIDE EFFECT DERIVED from the surviving ledger — never stored\n * separately, never fired during replay (recovery.md: add to the ledger during\n * recovery; let recovery-END re-emit the survivors).\n *\n * Anti-patterns this file refuses (mirroring durable-effects.md):\n *   - A side-table ledger persisted apart from the events. The events ARE the\n *     ledger; the Map is rebuilt by folding them.\n *   - Re-firing every historical effect during replay. Only `survivingEffects`\n *     (post-fold) re-emits.\n *   - Assuming the receiver gets each effect exactly once. At-least-once: dedup\n *     by `id` at the receiver (`hasOwed` / `isConfirmed` here are the sender's\n *     view; the receiver owns its own dedup).\n */\n\nimport type { Cmd } from \"../index\";\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The two events the ledger folds. These are ordinary Msg variants — persist\n// them into the same event log `doEventSourcedStore` appends, and the ledger\n// rebuilds itself on the next activation with no extra storage.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/** Monotonic, gap-free delivery id — the single correlation + dedup key. */\nexport type DeliveryId = number;\n\n/**\n * An effect is now OWED: it has been decided but its delivery is not yet\n * confirmed. Adds `{ id → effect }` to the ledger when folded.\n *\n * Persist this BEFORE interpreting the effect (durable-effects.md rule:\n * \"persist the intent before deliver\"). A crash between persist and deliver is\n * fine — the surviving entry re-fires on activation. A crash before the persist\n * means the effect was never owed, so nothing is lost that the actor promised.\n */\nexport interface EffectOwed<E> extends Cmd<\"effect_owed\"> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/**\n * An owed effect has been CONFIRMED delivered. Removes its entry from the\n * ledger when folded. Persist this BEFORE acting on the confirmation\n * (\"persist the confirmation before confirmDelivery\").\n */\nexport interface EffectConfirmed extends Cmd<\"effect_confirmed\"> {\n  readonly id: DeliveryId;\n}\n\n/** The event union the ledger folds over. `E` is the consumer's effect type. */\nexport type EffectLedgerEvent<E> = EffectOwed<E> | EffectConfirmed;\n\n// ─────────────────────────────────────────────────────────────────────────────\n// The ledger itself — a pure value. Insertion-ordered by monotonic id, so\n// `survivingEffects` re-emits in owed-order without a sort.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * The pending-effects ledger: owed-but-unconfirmed effects keyed by their\n * monotonic delivery id. A pure value reconstructed by `foldLedger` — it is\n * never persisted on its own; the events are.\n *\n * `ReadonlyMap` preserves insertion order, which (because ids are appended\n * monotonically) is exactly id order — so iteration yields the survivors\n * oldest-first with no sort.\n */\nexport type PendingEffectsLedger<E> = ReadonlyMap<DeliveryId, E>;\n\n/** A single surviving entry to re-emit: its id and the effect it owes. */\nexport interface OwedEffect<E> {\n  readonly id: DeliveryId;\n  readonly effect: E;\n}\n\n/** The empty ledger — the fold's seed (a fresh actor owes nothing). */\nexport function emptyLedger<E>(): PendingEffectsLedger<E> {\n  return new Map<DeliveryId, E>();\n}\n\n/**\n * Apply ONE ledger event — the reducer at the heart of the fold.\n *\n *   - `effect_owed`      → add `{ id → effect }`.\n *   - `effect_confirmed` → remove `id` (no-op if already absent: a duplicate\n *     confirm, or a confirm for an id evicted with the actor — at-least-once\n *     tolerates both).\n *\n * Pure: returns a NEW ledger, never mutates the input — so folding the same\n * events twice (live and post-eviction) yields equal results, and a caller may\n * keep the prior ledger value.\n */\nexport function applyEffectEvent<E>(\n  ledger: PendingEffectsLedger<E>,\n  event: EffectLedgerEvent<E>,\n): PendingEffectsLedger<E> {\n  const next = new Map(ledger);\n  switch (event.type) {\n    case \"effect_owed\":\n      next.set(event.id, event.effect);\n      return next;\n    case \"effect_confirmed\":\n      next.delete(event.id);\n      return next;\n  }\n}\n\n/**\n * THE FOLD. Rebuild the ledger from an event stream — the same fold shape\n * `replay` uses for state. After a simulated eviction this is called over the\n * persisted log and yields a ledger byte-for-byte equal to the never-evicted\n * one, because a pure fold over identical input is identical.\n *\n * This is the function that proves \"no side table\": the ledger is `events`\n * reduced, nothing more.\n */\nexport function foldLedger<E>(\n  events: Iterable<EffectLedgerEvent<E>>,\n): PendingEffectsLedger<E> {\n  let ledger = emptyLedger<E>();\n  for (const event of events) ledger = applyEffectEvent(ledger, event);\n  return ledger;\n}\n\n/**\n * RE-EMIT ON ACTIVATION. Given the rebuilt ledger, the owed-but-unconfirmed\n * effects to re-fire — ordered oldest-first by monotonic id. On a fresh /\n * fully-confirmed actor this is empty (nothing re-emitted).\n *\n * Idempotency is the RECEIVER's job: it must dedup by `id`, because\n * at-least-once means a re-emitted already-handled id WILL arrive again\n * (e.g. an effect confirmed in the activation that hibernated before the\n * `effect_confirmed` event was persisted). Re-firing the same id is therefore\n * a no-op AT THE RECEIVER, not here.\n */\nexport function survivingEffects<E>(\n  ledger: PendingEffectsLedger<E>,\n): readonly OwedEffect<E>[] {\n  const out: OwedEffect<E>[] = [];\n  for (const [id, effect] of ledger) out.push({ id, effect });\n  return out;\n}\n\n/** Is this id still owed (unconfirmed) in the ledger? Sender-side view. */\nexport function isOwed<E>(\n  ledger: PendingEffectsLedger<E>,\n  id: DeliveryId,\n): boolean {\n  return ledger.has(id);\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// pendingEffectsLedger — the stateful, monotonic-id-issuing recorder.\n//\n// The pure `foldLedger` is the contract; this is the ergonomic driver a host\n// uses live. It owns the monotonic `deliveryId` (gap-free, shared across all\n// destinations — durable-effects.md), emits the `effect_owed` / `effect_confirmed`\n// events for the caller to PERSIST, and keeps an in-memory mirror folded from\n// those same events so `survivingEffects` is available without a re-read.\n//\n// Mirrors `deferredGateway`'s factory shape: no clock / RNG captured; pure\n// bookkeeping. The caller is responsible for persisting each returned event\n// into the log (so the ledger survives eviction) and for actually interpreting\n// the effect after the owed event is durable.\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * A live, monotonic-id-issuing ledger recorder.\n *\n *   - `owe(effect)` — allocate the next `deliveryId`, return the\n *     `effect_owed` event to PERSIST plus the allocated `id`. Folding the event\n *     into the recorder's mirror is done for you; the caller persists it.\n *   - `confirm(id)` — return the `effect_confirmed` event to PERSIST, and `true`\n *     iff the id was owed (a duplicate confirm returns `false` — the boolean is\n *     itself a dedup signal, exactly Akka `confirmDelivery`).\n *   - `surviving()` — the current owed-but-unconfirmed effects (for re-emit on\n *     activation).\n *   - `ledger()` — the current folded ledger value.\n *   - `lastId()` — the highest id issued (so a host can seed the counter from a\n *     rebuilt ledger after eviction; see `restore`).\n */\nexport interface PendingEffectsRecorder<E> {\n  owe(effect: E): { id: DeliveryId; event: EffectOwed<E> };\n  confirm(id: DeliveryId): { confirmed: boolean; event: EffectConfirmed };\n  surviving(): readonly OwedEffect<E>[];\n  ledger(): PendingEffectsLedger<E>;\n  lastId(): DeliveryId;\n}\n\n/**\n * Build a live recorder. `restore` rehydrates it after an eviction: pass the\n * events read back from the log (or the rebuilt ledger's survivors) so the\n * monotonic counter resumes WITHOUT gaps and the mirror reflects the surviving\n * owed set. Omit `restore` for a fresh actor.\n *\n * Counter seeding rule: the next id is `max(seen ids) + 1`. Restoring only the\n * survivors is sufficient for correctness of re-emit, but to keep ids gap-free\n * across confirmed-and-pruned entries the host should pass `lastId` explicitly\n * when it has it (e.g. persisted alongside the snapshot). When only survivors\n * are known, the counter resumes from the highest surviving id — a confirmed id\n * higher than every survivor could in principle be reissued, so a host that\n * needs strict global monotonicity persists `lastId`.\n */\nexport function pendingEffectsLedger<E>(restore?: {\n  readonly events?: Iterable<EffectLedgerEvent<E>>;\n  readonly lastId?: DeliveryId;\n}): PendingEffectsRecorder<E> {\n  let mirror: PendingEffectsLedger<E> = restore?.events\n    ? foldLedger(restore.events)\n    : emptyLedger<E>();\n\n  // Seed the monotonic counter. Prefer an explicit `lastId` (gap-free across\n  // pruned ids); else the highest id observed in the restore events; else the\n  // highest surviving id; else 0 (fresh).\n  let counter = restore?.lastId ?? 0;\n  if (restore?.lastId === undefined && restore?.events) {\n    for (const e of restore.events) if (e.id > counter) counter = e.id;\n  } else if (restore?.lastId === undefined) {\n    for (const id of mirror.keys()) if (id > counter) counter = id;\n  }\n\n  return {\n    owe(effect) {\n      counter += 1;\n      const id = counter;\n      const event: EffectOwed<E> = { type: \"effect_owed\", id, effect };\n      mirror = applyEffectEvent(mirror, event);\n      return { id, event };\n    },\n    confirm(id) {\n      const confirmed = mirror.has(id);\n      const event: EffectConfirmed = { type: \"effect_confirmed\", id };\n      mirror = applyEffectEvent(mirror, event);\n      return { confirmed, event };\n    },\n    surviving() {\n      return survivingEffects(mirror);\n    },\n    ledger() {\n      return mirror;\n    },\n    lastId() {\n      return counter;\n    },\n  };\n}\n"]}

package/dist/chunk-5VNWZADP.js

@@ -0,0 +1,49 @@
+// src/retry-backoff/index.ts
+function asRng(fn, probe = false) {
+  if (probe) {
+    const sample = fn();
+    if (!(sample >= 0 && sample < 1)) {
+      throw new RangeError(
+        `asRng: generator returned ${sample}, outside the [0, 1) contract`
+      );
+    }
+  }
+  return fn;
+}
+var defaultRng = Math.random;
+var defaultRetryPolicy = {
+  baseMs: 100,
+  factor: 2,
+  capMs: 3e4,
+  maxAttempts: 5,
+  jitter: "full"
+};
+function backoffDelay(attempt, policy, rng = defaultRng) {
+  const safeAttempt = attempt < 0 ? 0 : attempt;
+  const exponential = policy.baseMs * policy.factor ** safeAttempt;
+  const d = Number.isNaN(exponential) ? 0 : Math.min(policy.capMs, exponential);
+  switch (policy.jitter) {
+    case "none":
+      return d;
+    case "full":
+      return Math.min(d, rng() * d);
+    case "equal":
+      return Math.min(d, d / 2 + rng() * (d / 2));
+  }
+}
+function initRetry() {
+  return { attempt: 0 };
+}
+function recordFailure(state, error) {
+  return { attempt: state.attempt + 1, lastError: error };
+}
+function shouldRetry(state, policy) {
+  return state.attempt < policy.maxAttempts;
+}
+function nextDelayMs(state, policy, rng = defaultRng) {
+  return backoffDelay(state.attempt, policy, rng);
+}
+
+export { asRng, backoffDelay, defaultRetryPolicy, defaultRng, initRetry, nextDelayMs, recordFailure, shouldRetry };
+//# sourceMappingURL=chunk-5VNWZADP.js.map
+//# sourceMappingURL=chunk-5VNWZADP.js.map

package/dist/chunk-5VNWZADP.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/retry-backoff/index.ts"],"names":[],"mappings":";AA8EO,SAAS,KAAA,CAAM,EAAA,EAAkB,KAAA,GAAQ,KAAA,EAAY;AAC1D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,MAAM,SAAS,EAAA,EAAG;AAClB,IAAA,IAAI,EAAE,MAAA,IAAU,CAAA,IAAK,MAAA,GAAS,CAAA,CAAA,EAAI;AAChC,MAAA,MAAM,IAAI,UAAA;AAAA,QACR,6BAA6B,MAAM,CAAA,6BAAA;AAAA,OACrC;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,EAAA;AACT;AAOO,IAAM,aAAkB,IAAA,CAAK;AA4B7B,IAAM,kBAAA,GAAkC;AAAA,EAC7C,MAAA,EAAQ,GAAA;AAAA,EACR,MAAA,EAAQ,CAAA;AAAA,EACR,KAAA,EAAO,GAAA;AAAA,EACP,WAAA,EAAa,CAAA;AAAA,EACb,MAAA,EAAQ;AACV;AAuBO,SAAS,YAAA,CACd,OAAA,EACA,MAAA,EACA,GAAA,GAAW,UAAA,EACH;AAIR,EAAA,MAAM,WAAA,GAAc,OAAA,GAAU,CAAA,GAAI,CAAA,GAAI,OAAA;AACtC,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,WAAA;AAMrD,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,GAAI,IAAI,IAAA,CAAK,GAAA,CAAI,MAAA,CAAO,KAAA,EAAO,WAAW,CAAA;AAE5E,EAAA,QAAQ,OAAO,MAAA;AAAQ,IACrB,KAAK,MAAA;AACH,MAAA,OAAO,CAAA;AAAA,IACT,KAAK,MAAA;AAKH,MAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,GAAA,KAAQ,CAAC,CAAA;AAAA,IAC9B,KAAK,OAAA;AAGH,MAAA,OAAO,IAAA,CAAK,IAAI,CAAA,EAAG,CAAA,GAAI,IAAI,GAAA,EAAI,IAAK,IAAI,CAAA,CAAE,CAAA;AAAA;AAEhD;AAgBO,SAAS,SAAA,GAAwB;AACtC,EAAA,OAAO,EAAE,SAAS,CAAA,EAAE;AACtB;AAMO,SAAS,aAAA,CAAc,OAAmB,KAAA,EAA4B;AAC3E,EAAA,OAAO,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,GAAU,CAAA,EAAG,WAAW,KAAA,EAAM;AACxD;AASO,SAAS,WAAA,CAAY,OAAmB,MAAA,EAA8B;AAC3E,EAAA,OAAO,KAAA,CAAM,UAAU,MAAA,CAAO,WAAA;AAChC;AASO,SAAS,WAAA,CACd,KAAA,EACA,MAAA,EACA,GAAA,GAAW,UAAA,EACH;AACR,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,OAAA,EAAS,MAAA,EAAQ,GAAG,CAAA;AAChD","file":"chunk-5VNWZADP.js","sourcesContent":["/**\n * @demlik/tea/retry-backoff — exponential backoff with jitter + cap, and the\n * retry-attempt state every fallible `interpret` handler folds over.\n *\n * This is a \"pure state + ops\" module in the same mold as\n * `@demlik/tea/work-queue`: a state type plus pure transition functions,\n * storage- and host-agnostic, that a consumer wires into their own reducer /\n * interpret. Nothing here reads the clock or the RNG on its own behalf —\n * randomness is *injected* (`rng`) and time is *computed by the caller* from\n * the millisecond delays this module returns. That keeps every function\n * deterministic and unit-testable, and keeps the substrate's purity invariants\n * intact when the result is threaded through `update` (invariant 2) and the\n * delay is realized as a `Cmd` the runtime performs (invariant 3).\n *\n * Typical wiring:\n *\n *   // in `update`, on a failure Msg:\n *   const retry = recordFailure(state.retry, msg.error);\n *   if (!shouldRetry(retry, policy)) return [toGaveUp(state), []];\n *   const delayMs = nextDelayMs(retry, policy);              // pure: rng injected at call site\n *   return [{ ...state, retry }, [{ type: \"ScheduleRetry\", delayMs, into: TimerFiredRetry }]];\n *\n * The reducer stays pure: `nextDelayMs` is called with the runtime's RNG only\n * at the emit boundary (or the caller defers the whole delay computation to the\n * `interpret` handler and passes `rng` there). Either way the substrate never\n * sees `Math.random()` inside a transition body.\n *\n * NOT a substrate primitive: it depends on nothing from `../index`. It is a\n * leaf utility consumers reach via the `@demlik/tea/retry-backoff` subpath.\n */\n\n/**\n * Jitter strategy applied to the computed backoff delay.\n *\n * Names follow the AWS \"Exponential Backoff And Jitter\" taxonomy (Brooker,\n * 2015), the same vocabulary used by the AWS SDKs and most retry libraries:\n *\n *   - `\"none\"`  — no jitter; the delay is the raw capped exponential `d`.\n *                 Deterministic, but synchronizes retries across clients\n *                 (thundering herd). Use only when callers are already\n *                 de-correlated by other means.\n *   - `\"full\"`  — uniform random in `[0, d]`. Maximum spread; best herd\n *                 avoidance, highest variance in latency.\n *   - `\"equal\"` — `d/2 + random(0, d/2)`, i.e. uniform in `[d/2, d]`. Half the\n *                 delay is fixed, half is jittered: keeps a latency floor while\n *                 still de-correlating clients. A common default.\n */\nexport type Jitter = \"none\" | \"full\" | \"equal\";\n\ndeclare const RngBrand: unique symbol;\n\n/**\n * A source of uniform randomness in `[0, 1)` — the `Math.random` contract.\n *\n * Nominally branded so the `[0, 1)` range is enforced at *construction*, not\n * by a comment. A raw `() => number` does NOT satisfy `Rng`: a stray `() => 5`\n * or `() => -1` is rejected by the type before it can ever feed the jitter\n * math and breach the `0 <= delay <= capMs` postcondition. The only way to\n * mint an `Rng` is {@link asRng} (or the {@link defaultRng} const), so the\n * range obligation lives at the boundary where randomness enters the module —\n * \"parse, don't validate\" applied to a function value.\n */\nexport type Rng = (() => number) & { readonly [RngBrand]: true };\n\n/**\n * Brand a `[0, 1)` generator as an {@link Rng}. The single entry point for\n * randomness into this module: callers (production wiring and tests alike)\n * pass their raw generator through here, which optionally asserts the contract\n * and tags the value. The probe is a cheap guard against the most common\n * misuse (returning a non-unit value); it does not — and cannot — prove\n * uniformity.\n *\n * PURE with respect to the module: it neither reads the clock nor calls the\n * generator on the module's behalf unless `probe` is set. The probe is opt-in\n * (default off) so wrapping a hot generator stays allocation- and call-free.\n *\n * @throws RangeError if `probe` is enabled and a sampled value is outside `[0, 1)`.\n */\nexport function asRng(fn: () => number, probe = false): Rng {\n  if (probe) {\n    const sample = fn();\n    if (!(sample >= 0 && sample < 1)) {\n      throw new RangeError(\n        `asRng: generator returned ${sample}, outside the [0, 1) contract`,\n      );\n    }\n  }\n  return fn as Rng;\n}\n\n/**\n * The production default: `Math.random`, branded. Used wherever an `Rng` is\n * required but the caller omits one — at the effect boundary, never inside a\n * reducer.\n */\nexport const defaultRng: Rng = Math.random as Rng;\n\n/**\n * A retry policy is pure configuration — the knobs of the backoff curve. It\n * carries no mutable state; `RetryState` does. One policy is shared across all\n * the attempts of one logical operation (often a module-scope const).\n */\nexport interface RetryPolicy {\n  /** Delay for attempt 0, in milliseconds, before any jitter or cap. */\n  readonly baseMs: number;\n  /** Geometric growth factor. `2` doubles the delay each attempt. */\n  readonly factor: number;\n  /** Hard ceiling, in milliseconds. The capped exponential never exceeds this. */\n  readonly capMs: number;\n  /**\n   * Maximum number of attempts. `shouldRetry` allows attempts `0 .. maxAttempts-1`,\n   * so `maxAttempts: 3` means \"try once, then retry at most twice\" (attempts 0, 1, 2).\n   */\n  readonly maxAttempts: number;\n  /** Jitter strategy applied to the capped exponential delay. */\n  readonly jitter: Jitter;\n}\n\n/**\n * Sensible defaults: 100ms base, doubling, capped at 30s, up to 5 attempts,\n * full jitter (the herd-avoidance default). Tuned for network calls; override\n * per call site rather than mutating this shared const.\n */\nexport const defaultRetryPolicy: RetryPolicy = {\n  baseMs: 100,\n  factor: 2,\n  capMs: 30_000,\n  maxAttempts: 5,\n  jitter: \"full\",\n};\n\n/**\n * Compute the delay for a given 0-based `attempt` under `policy`.\n *\n * PURE. The exponential is `baseMs * factor ** attempt`, clamped to `capMs`,\n * then jittered. `rng` is injected so the result is deterministic in tests —\n * pass an `rng` returning a fixed value to pin the jitter; the production\n * default reads `Math.random` only when the caller omits it (at the effect\n * boundary, never inside a reducer).\n *\n * `rng` is an {@link Rng} — a `[0, 1)` generator branded at construction via\n * {@link asRng}, so a raw `() => 5` can't be passed here. The returned delay\n * is always in `[0, capMs]` regardless of jitter strategy:\n *   - `\"none\"`  → exactly the capped exponential `d`.\n *   - `\"full\"`  → `rng() * d`, uniform in `[0, d]`.\n *   - `\"equal\"` → `d/2 + rng() * d/2`, uniform in `[d/2, d]`.\n *\n * `attempt` is treated as `>= 0`; a negative attempt is clamped to 0 so a\n * caller's off-by-one never produces a fractional exponent or a delay below\n * `baseMs`. `capMs` is also the floor of the clamp, so a misconfigured\n * `capMs < baseMs` still yields a delay within `[0, capMs]`.\n */\nexport function backoffDelay(\n  attempt: number,\n  policy: RetryPolicy,\n  rng: Rng = defaultRng,\n): number {\n  // Clamp the attempt to >= 0 so factor ** attempt is never a fractional /\n  // negative exponent. The exponential can overflow to Infinity for large\n  // attempts; Math.min with capMs collapses that back to the ceiling.\n  const safeAttempt = attempt < 0 ? 0 : attempt;\n  const exponential = policy.baseMs * policy.factor ** safeAttempt;\n  // `factor ** attempt` overflows to Infinity for large attempts. With\n  // `baseMs > 0` that's `Infinity`, which Math.min collapses back to `capMs`.\n  // With `baseMs === 0` it's `0 * Infinity === NaN`; a zero base means zero\n  // delay, so treat NaN as 0 (otherwise NaN poisons the comparison and breaks\n  // the `0 <= delay <= capMs` postcondition).\n  const d = Number.isNaN(exponential) ? 0 : Math.min(policy.capMs, exponential);\n\n  switch (policy.jitter) {\n    case \"none\":\n      return d;\n    case \"full\":\n      // Uniform in [0, d]. Math.min re-pins the upper bound: at subnormal /\n      // extreme-precision `d`, `rng() * d` can round one ULP above `d`, which\n      // would breach the documented `delay <= capMs` postcondition. Clamping to\n      // `d` (already <= capMs) makes the invariant hold by construction.\n      return Math.min(d, rng() * d);\n    case \"equal\":\n      // Fixed half + jittered half → uniform in [d/2, d]. Same FP-rounding clamp\n      // as \"full\": `d/2 + rng()*(d/2)` can round above `d` for subnormal `d`.\n      return Math.min(d, d / 2 + rng() * (d / 2));\n  }\n}\n\n/**\n * Per-operation retry state: how many attempts have failed so far, and the most\n * recent error. `lastError` is `unknown` because the failure can be anything a\n * boundary surfaces (an `Error`, a tagged result, a string) — this module never\n * inspects it, it only carries it forward for the consumer's reducer to read.\n */\nexport interface RetryState {\n  /** Count of failures recorded so far. Also the 0-based index of the next attempt. */\n  readonly attempt: number;\n  /** The error from the most recent failure, if any. Carried, never interpreted. */\n  readonly lastError?: unknown;\n}\n\n/** The starting state: zero attempts, no error yet. */\nexport function initRetry(): RetryState {\n  return { attempt: 0 };\n}\n\n/**\n * Record a failed attempt. PURE — returns a *new* state with `attempt`\n * incremented and `lastError` set; the input `state` is never mutated.\n */\nexport function recordFailure(state: RetryState, error: unknown): RetryState {\n  return { attempt: state.attempt + 1, lastError: error };\n}\n\n/**\n * Whether another attempt is permitted under `policy`. PURE.\n *\n * `attempt` is the number of failures recorded so far (= the index of the next\n * attempt). We may retry while that index is below `maxAttempts`, i.e. attempts\n * `0 .. maxAttempts-1` are allowed and the `maxAttempts`-th is refused.\n */\nexport function shouldRetry(state: RetryState, policy: RetryPolicy): boolean {\n  return state.attempt < policy.maxAttempts;\n}\n\n/**\n * The delay to wait before the next attempt, given the current state. PURE.\n *\n * Bridges `RetryState` → `backoffDelay` by using `state.attempt` as the 0-based\n * attempt index, so the delay grows with each recorded failure. `rng` is\n * injected for determinism, same contract as `backoffDelay`.\n */\nexport function nextDelayMs(\n  state: RetryState,\n  policy: RetryPolicy,\n  rng: Rng = defaultRng,\n): number {\n  return backoffDelay(state.attempt, policy, rng);\n}\n"]}

package/dist/{chunk-ZRUST6BK.js → chunk-7FYQGDMF.js}

@@ -58,5 +58,5 @@ function arbGuidedSequence(_machine, _ctx, _cells, _opts) {
 }
 
 export { arbConstantMsg, arbGuidedSequence, arbMsg, arbMsgSequence, arbRecordMsg, stubCtxThrowingProxy };
-//# sourceMappingURL=chunk-ZRUST6BK.js.map
-//# sourceMappingURL=chunk-ZRUST6BK.js.map
+//# sourceMappingURL=chunk-7FYQGDMF.js.map
+//# sourceMappingURL=chunk-7FYQGDMF.js.map

package/dist/chunk-7FYQGDMF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pbt/arbitraries/ctx.ts","../src/pbt/arbitraries/msg.ts","../src/pbt/arbitraries/sequence.ts"],"names":["fc2"],"mappings":";;;AAyCO,SAAS,oBAAA,GAAiC;AAC/C,EAAA,MAAM,OAAA,GAAgC;AAAA,IACpC,GAAA,CAAI,SAAS,IAAA,EAAgC;AAK3C,MAAA,IAAI,OAAO,IAAA,KAAS,QAAA,EAAU,OAAO,MAAA;AAKrC,MAAA,IACE,SAAS,QAAA,IACT,IAAA,KAAS,cACT,IAAA,KAAS,SAAA,IACT,SAAS,MAAA,EACT;AACA,QAAA,OAAO,MAAA;AAAA,MACT;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oFACgB,IAAI,CAAA,wEAAA;AAAA,OAEtB;AAAA,IACF,CAAA;AAAA,IACA,GAAA,GAAe;AACb,MAAA,OAAO,KAAA;AAAA,IACT,CAAA;AAAA,IACA,OAAA,GAAsC;AACpC,MAAA,OAAO,EAAC;AAAA,IACV;AAAA,GACF;AACA,EAAA,OAAO,IAAI,KAAA,CAAM,EAAC,EAAG,OAAO,CAAA;AAC9B;ACfO,SAAS,MAAA,CACd,OACA,IAAA,EACiB;AACjB,EAAA,MAAM,UAAU,IAAA,EAAM,OAAA;AACtB,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA;AACpC,EAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,WAAW,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,MAAO;AAAA,IAC5C,SAAA,EAAW,GAAA;AAAA,IACX,MAAA,EAAQ,OAAA,GAAU,GAAG,CAAA,IAAK;AAAA,GAC5B,CAAE,CAAA;AACF,EAAA,OAAU,EAAA,CAAA,KAAA,CAAM,GAAG,QAAQ,CAAA;AAC7B;AASO,SAAS,eACd,IAAA,EAC2B;AAC3B,EAAA,OAAU,EAAA,CAAA,QAAA,CAAS,EAAE,IAAA,EAAM,CAAA;AAC7B;AAWO,SAAS,YAAA,CACd,MACA,MAAA,EAC+B;AAa/B,EAAA,MAAM,iBAAA,GAA2D;AAAA,IAC/D,IAAA,EAAS,YAAS,IAAI,CAAA;AAAA,IACtB,GAAI;AAAA,GACN;AACA,EAAA,OAAU,UAAO,iBAAiB,CAAA;AAGpC;ACvFO,SAAS,cAAA,CACd,QACA,IAAA,EAK4B;AAC5B,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,CAAA;AACrC,EAAA,MAAM,SAAA,GAAY,MAAM,SAAA,IAAa,EAAA;AACrC,EAAA,MAAM,MAAA,GAAS,IAAA,EAAM,MAAA,IAAU,EAAC;AAChC,EAAA,MAAM,OAAUA,EAAA,CAAA,KAAA,CAAM,MAAA,EAAQ,EAAE,SAAA,EAAW,WAAW,CAAA;AACtD,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AAChC,EAAA,OAAO,IAAA,CAAK,IAAI,CAAC,GAAA,KAAQ,CAAC,GAAG,MAAA,EAAQ,GAAG,GAAG,CAAC,CAAA;AAC9C;AAWO,SAAS,iBAAA,CAOd,QAAA,EACA,IAAA,EACA,MAAA,EAKA,KAAA,EAC4B;AAC5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GAIF;AACF","file":"chunk-7FYQGDMF.js","sourcesContent":["// ---------------------------------------------------------------------------\n// `stubCtxThrowingProxy<Ctx>()` — a Proxy that satisfies the Ctx type-shape\n// at compile time but throws on every property access at runtime.\n//\n// Why this exists: PBT runs the pure reducer surface ONLY — `replay` never\n// invokes `interpret` and never starts a Sub, so Ctx should never be\n// dereferenced during property generation. But the substrate's `replay`\n// signature requires a `ctx: Ctx` value at compile time (it forwards ctx\n// into `init`, which on some machines IS pure but on others reads ctx). A\n// hand-rolled `{} as Ctx` would silently pass through any accidental ctx\n// access — exactly the silent footgun this proxy catches.\n//\n// Open question 2 (design doc): we ship this as the default. Tests that\n// genuinely need a working ctx (because their `init` reads from it) can\n// pass a real ctx value instead — the proxy is opt-in, not load-bearing.\n//\n// Strengthens invariant 6 (no silent failures — accidental ctx reads\n// produce a useful error, not a `undefined.foo` confusion later).\n// ---------------------------------------------------------------------------\n\n/**\n * Build a Ctx value whose every property access throws. Use as the `ctx`\n * argument to PBT runners when the reducer under test is pure (does not\n * read from ctx). Accidental ctx access during property generation\n * surfaces as a labelled error instead of a silent `undefined` or\n * downstream type-error.\n *\n * Returns a typed `Ctx` (via `as unknown as Ctx`) — the proxy satisfies the\n * type-shape requirement at the call site; the runtime contract is\n * \"throw on first read.\" The `as unknown` cast is the one boundary cast\n * this helper requires; the proxy is structurally a `Ctx` for every\n * property accessor.\n *\n * @example\n *   import { stubCtxThrowingProxy } from \"../index\";\n *   const ctx = stubCtxThrowingProxy<MyCtx>();\n *   propertyTerminates(machine, ctx, ...);\n *   // If anything reads ctx.someField during the run, an Error throws:\n *   //   \"@demlik/tea/pbt: ctx access denied (PBT operates on the pure\n *   //    reducer; ctx field 'someField' was read)\"\n */\nexport function stubCtxThrowingProxy<Ctx>(): Ctx {\n  const handler: ProxyHandler<object> = {\n    get(_target, prop: string | symbol): unknown {\n      // Allow vitest / fast-check internals to introspect via Symbol-keyed\n      // checks (e.g. Symbol.toStringTag, Symbol.iterator). Returning\n      // undefined on symbol keys keeps property-tree walks cheap; the\n      // throw fires on real domain field reads.\n      if (typeof prop === \"symbol\") return undefined;\n      // Some shrinkers / pretty-printers in fast-check probe a small set\n      // of conventional field names (`toJSON`, `toString`, `valueOf`,\n      // `then` — the last for thenable-check). Return undefined for those\n      // so the proxy doesn't fail a probe before the property body runs.\n      if (\n        prop === \"toJSON\" ||\n        prop === \"toString\" ||\n        prop === \"valueOf\" ||\n        prop === \"then\"\n      ) {\n        return undefined;\n      }\n      throw new Error(\n        `@demlik/tea/pbt: ctx access denied (PBT operates on the pure reducer; ` +\n          `ctx field '${prop}' was read). Pass a real ctx value if the reducer's ` +\n          `init reads from ctx.`,\n      );\n    },\n    has(): boolean {\n      return false;\n    },\n    ownKeys(): ArrayLike<string | symbol> {\n      return [];\n    },\n  };\n  return new Proxy({}, handler) as unknown as Ctx;\n}\n","// ---------------------------------------------------------------------------\n// Msg arbitrary builders.\n//\n// `MsgArbitraryTable<M>` is a strict mapped type — every Msg variant must\n// have an arbitrary entry, keyed by `M[\"type\"]`, narrowing the arbitrary's\n// `T` to `Extract<M, { type: K }>`. This mirrors the load-bearing discipline\n// of `Reducer<S, M, C>` and `Transitions<S, M, C>` in the substrate: adding\n// a Msg variant without an arbitrary fails to compile, not at runtime.\n//\n// `arbMsg(table, opts?)` collapses the table into a single `fc.Arbitrary<M>`\n// via `fc.oneof`. Optional per-variant weighting for sequence-skew tests.\n//\n// `arbConstantMsg(type)` / `arbRecordMsg(type, fields)` are sugar over\n// `fc.constant({ type })` / `fc.record({ type: fc.constant(type), ...fields })`.\n// They exist because every Msg variant arbitrary either (a) carries no\n// payload — `arbConstantMsg(\"stop\")` — or (b) carries a record of fields —\n// `arbRecordMsg(\"tick\", { now: fc.integer() })`. Naming the two shapes\n// prevents callers from hand-rolling `fc.record({ type: fc.constant(\"...\") })`\n// inconsistently across test files.\n//\n// Open question 1 from the design doc (strict vs Partial table): strict by\n// default. The mapped type catches drift at compile time; `arbMsgPartial`\n// sugar is a future addition iff friction becomes real.\n// ---------------------------------------------------------------------------\n\nimport * as fc from \"fast-check\";\n\n/**\n * Strict per-variant Msg arbitrary table. Mapped type: every key in\n * `M[\"type\"]` MUST have an arbitrary entry whose `T` is the narrowed\n * variant. Adding a new Msg variant without an entry is a compile error\n * (same load-bearing discipline as `Reducer<S, M, C>` in the substrate).\n *\n * @example\n *   type Msg = { type: \"start\" } | { type: \"tick\"; now: number };\n *   const table: MsgArbitraryTable<Msg> = {\n *     start: arbConstantMsg(\"start\"),\n *     tick: arbRecordMsg(\"tick\", { now: fc.integer({ min: 0 }) }),\n *   };\n */\nexport type MsgArbitraryTable<M extends { type: string }> = {\n  [K in M[\"type\"]]: fc.Arbitrary<Extract<M, { type: K }>>;\n};\n\n/**\n * Build a single `fc.Arbitrary<M>` from a `MsgArbitraryTable<M>`. Picks one\n * variant per generation via `fc.oneof`; optional per-variant `weights`\n * bias the distribution (default uniform).\n *\n * @param table   Per-variant arbitrary table (strict — every variant required).\n * @param opts    Optional bias: `weights` is a `Partial<Record<M[\"type\"], number>>`.\n *                Variants without an explicit weight default to 1.\n *\n * @example\n *   const msgArb = arbMsg<Msg>({\n *     start: arbConstantMsg(\"start\"),\n *     tick:  arbRecordMsg(\"tick\", { now: fc.integer() }),\n *     stop:  arbConstantMsg(\"stop\"),\n *   }, { weights: { tick: 5, start: 1, stop: 1 } });\n */\nexport function arbMsg<M extends { type: string }>(\n  table: MsgArbitraryTable<M>,\n  opts?: { weights?: Partial<Record<M[\"type\"], number>> },\n): fc.Arbitrary<M> {\n  const weights = opts?.weights;\n  const entries = Object.entries(table) as [M[\"type\"], fc.Arbitrary<M>][];\n  if (entries.length === 0) {\n    throw new Error(\"@demlik/tea/pbt: arbMsg table is empty\");\n  }\n  const weighted = entries.map(([key, arb]) => ({\n    arbitrary: arb,\n    weight: weights?.[key] ?? 1,\n  }));\n  return fc.oneof(...weighted);\n}\n\n/**\n * Build a payload-free Msg variant arbitrary. Sugar for\n * `fc.constant({ type })` that narrows the result to `{ type: T }` literal.\n *\n * @example\n *   arbConstantMsg(\"stop\") // fc.Arbitrary<{ type: \"stop\" }>\n */\nexport function arbConstantMsg<T extends string>(\n  type: T,\n): fc.Arbitrary<{ type: T }> {\n  return fc.constant({ type });\n}\n\n/**\n * Build a record-shaped Msg variant arbitrary. Sugar for\n * `fc.record({ type: fc.constant(type), ...fields })` that stamps the\n * discriminator literal and combines with the per-field arbitraries.\n *\n * @example\n *   arbRecordMsg(\"tick\", { now: fc.integer({ min: 0 }) })\n *   // fc.Arbitrary<{ type: \"tick\"; now: number }>\n */\nexport function arbRecordMsg<T extends string, R>(\n  type: T,\n  fields: { [K in keyof R]: fc.Arbitrary<R[K]> },\n): fc.Arbitrary<{ type: T } & R> {\n  // `fc.record` builds an arbitrary of the merged-shape record. The\n  // `type: fc.constant(type)` field stamps the literal discriminator;\n  // the spread of `fields` provides every payload field's arbitrary.\n  //\n  // The intermediate `as Record<string, fc.Arbitrary<unknown>>` is the\n  // single load-bearing cast — fc.record's parameter type is invariant in\n  // its inferred field shape, and the merged literal-and-generic spread\n  // doesn't unify with the strict `{ [K in keyof R]: Arbitrary<R[K]> }`\n  // shape TS computes for us. The outer cast to `fc.Arbitrary<{ type: T }\n  // & R>` restates the result shape we know to be correct at this\n  // boundary. Mirrors the same discipline `fc.record` callers use\n  // throughout the prior-art branch.\n  const recordArbitraries: Record<string, fc.Arbitrary<unknown>> = {\n    type: fc.constant(type),\n    ...(fields as Record<string, fc.Arbitrary<unknown>>),\n  };\n  return fc.record(recordArbitraries) as unknown as fc.Arbitrary<\n    { type: T } & R\n  >;\n}\n","// ---------------------------------------------------------------------------\n// Msg-sequence arbitraries.\n//\n// `arbMsgSequence(msgArb, opts)` produces `fc.Arbitrary<readonly M[]>` —\n// fast-check's default-shrinker handles the array; the per-element shrinker\n// inside `msgArb` shrinks each variant. Optional `prefix` is prepended\n// verbatim (used by Test A: \"the bug-triggering Msg leads the sequence\").\n//\n// `arbGuidedSequence` is the state-aware sequence builder. In v1 it throws\n// — Phase 6 of the design doc lands the `fc.commands`-backed implementation.\n// The export exists today so the surface is forward-compatible: consumers\n// that need state-aware generation get a useful error pointing at the\n// design doc instead of \"is not a function.\"\n// ---------------------------------------------------------------------------\n\nimport * as fc from \"fast-check\";\nimport type { Cmd, Machine, Sub } from \"../../index\";\n\n/**\n * Build an arbitrary of Msg sequences over a per-Msg arbitrary. Optionally\n * bounded in length and / or prefixed with a fixed sequence.\n *\n * - `minLength` (default 0) and `maxLength` (default 30) bound the random\n *   array length. `prefix` is prepended AFTER the random tail is built; the\n *   final length is `prefix.length + tail.length`.\n * - `prefix` is the load-bearing escape hatch for \"the first msg is the\n *   one that exercises the cell I care about\" (e.g. Test A's\n *   `[{ type: \"ws:client:hello\" }]` prefix to land in the\n *   `auditing.ws:client:hello` cell on the first transition).\n *\n * @example\n *   arbMsgSequence(msgArb, { minLength: 1, maxLength: 30 });\n *   arbMsgSequence(msgArb, { prefix: [{ type: \"ws:client:hello\" }], maxLength: 20 });\n */\nexport function arbMsgSequence<M extends { type: string }>(\n  msgArb: fc.Arbitrary<M>,\n  opts?: {\n    readonly minLength?: number;\n    readonly maxLength?: number;\n    readonly prefix?: readonly NoInfer<M>[];\n  },\n): fc.Arbitrary<readonly M[]> {\n  const minLength = opts?.minLength ?? 0;\n  const maxLength = opts?.maxLength ?? 30;\n  const prefix = opts?.prefix ?? [];\n  const tail = fc.array(msgArb, { minLength, maxLength });\n  if (prefix.length === 0) return tail;\n  return tail.map((arr) => [...prefix, ...arr]);\n}\n\n/**\n * State-aware Msg sequence arbitrary — generates only msgs whose\n * precondition holds in the current state. Backed by `fc.commands`\n * internally (Phase 6 of `.patterns/tea/tea-pbt-design.md`).\n *\n * **NOT IMPLEMENTED IN v1.** The export exists today so the surface is\n * forward-compatible; the design doc §7 ships this in Phase 6 alongside\n * shrinkers. Calling it throws.\n */\nexport function arbGuidedSequence<\n  S,\n  M extends { type: string },\n  C extends Cmd,\n  U extends Sub,\n  Ctx,\n>(\n  _machine: Machine<S, M, C, U, Ctx>,\n  _ctx: Ctx,\n  _cells: {\n    [K in M[\"type\"]]?: (\n      state: S,\n    ) => fc.Arbitrary<Extract<M, { type: K }>> | null;\n  },\n  _opts?: { maxLength?: number },\n): fc.Arbitrary<readonly M[]> {\n  throw new Error(\n    \"@demlik/tea/pbt: arbGuidedSequence is not implemented in v1 — see \" +\n      \".patterns/tea/tea-pbt-design.md §7 (Phase 6). Use arbMsgSequence with \" +\n      \"an unguided arbMsg table for now; states that don't accept a given \" +\n      \"msg should noop in the reducer (mapped-type discipline).\",\n  );\n}\n"]}